CVE-2023-37952: A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attacker...

Security readout for executives and security teams

Jenkins mabl Plugin 0.0.46 and earlier has a CSRF flaw that could let an attacker abuse a logged-in Jenkins user’s browser to send stored Jenkins credentials to an attacker-controlled URL. The attacker also needs credential IDs obtained separately. This is most concerning where Jenkins stores deployment, cloud, or source-control secrets. Exposure is limited to Jenkins environments with the mabl Plugin installed at version 0.0.46 or earlier, especially where Jenkins stores reusable credentials. Internet exposure of Jenkins increases concern, but the source bundle does not define required permissions or reachable endpoints. Prioritize review where Jenkins holds production, cloud, deployment, or repository credentials. This is not KEV-listed and active exploitation is not cited, but potential credential theft from CI/CD systems can create material downstream risk. Mitigation focus: Inventory Jenkins controllers for mabl Plugin 0.0.46 or earlier.; Check Jenkins advisory and plugin guidance for current fixed-version status.; Disable or remove the mabl Plugin if it is not required..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.