CVE-2022-36893: Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementin...

Security readout for executives and security teams

This Jenkins plugin issue lets a user with limited job read access test file patterns against a job workspace. They cannot necessarily read files, but they may infer whether sensitive or useful files exist. The source bundle does not provide a CVSS score, fixed version, or evidence of active exploitation. Exposure is limited to Jenkins instances using rpmsign-plugin 0.5.0 or earlier where untrusted or low-privilege users have Item/Read on jobs with workspaces containing sensitive paths or filenames. Treat this as a targeted Jenkins hardening item. Prioritize if your Jenkins environment has many semi-trusted users, shared jobs, or workspaces containing sensitive build artifacts. No active exploitation evidence is provided. Mitigation focus: Inventory Jenkins controllers for rpmsign-plugin and record installed versions.; Check Jenkins advisory guidance for available plugin updates or removal guidance.; Restrict Item/Read access to trusted users only..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.