CVE-2022-36892: Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementin...

Security readout for executives and security teams

This Jenkins plugin issue can let a logged-in user with basic job read access infer whether chosen file patterns match files in a job workspace. That can expose clues about workspace contents, but the provided sources do not describe code execution, administrator compromise, or unauthenticated access. Exposure is limited to Jenkins installations that have rhnpush-plugin 0.5.1 or earlier installed and grant Item/Read to users who should not inspect workspace contents. Treat this as a targeted Jenkins information-disclosure risk, not an emergency unless untrusted users have job read access or workspaces contain sensitive artifacts. Prioritize inventory and permission review. Mitigation focus: Inventory Jenkins controllers for rhnpush-plugin and its installed version.; Check Jenkins advisory and plugin guidance for an available fixed release or retirement status.; Remove or disable rhnpush-plugin if it is not operationally required..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.