CVE-2022-36901: Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global config...

Security readout for executives and security teams

This issue can expose stored HTTP Request Plugin passwords on a Jenkins controller because versions 1.15 and earlier store them unencrypted in global configuration. The main business risk is credential disclosure to anyone who can read the controller filesystem, potentially enabling downstream access where those passwords are reused. Exposure is likely limited to Jenkins environments using HTTP Request Plugin 1.15 or earlier with stored HTTP request passwords. Systems without the plugin, without stored passwords, or without filesystem exposure are less directly affected. Treat this as a credential exposure issue, not a remote-code-execution emergency. Prioritize Jenkins controllers that store production or third-party service passwords and have broad administrator, host, backup, or support-bundle access. Mitigation focus: Check Jenkins vendor advisory for the fixed plugin version and upgrade guidance.; Restrict Jenkins controller filesystem access to only required administrators and service accounts.; Rotate any HTTP Request Plugin passwords that may have been stored in plaintext..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.