CVE-2022-36891: A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attacke...

Security readout for executives and security teams

This Jenkins plugin issue lets a user who can read a job see deployment logs even if they lack deployment permission. The main business risk is unintended disclosure of deployment details, credentials, infrastructure names, or operational context if those logs contain sensitive data. Exposure is limited to Jenkins environments using the Deployer Framework Plugin where non-deployer users have Item/Read access to jobs with deployment logs. Treat as a targeted information-disclosure issue. Prioritize Jenkins instances where deployment logs may expose credentials or production infrastructure details, especially if many users have job read access. Mitigation focus: Identify Jenkins controllers using Deployer Framework Plugin 85.v1d1888e8c021 or earlier.; Check Jenkins advisory and plugin guidance for current fixed or removal recommendations.; Restrict Item/Read access to trusted users on jobs with deployment logs..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.