CVE-2023-37953: A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read per...

Security readout for executives and security teams

Jenkins mabl Plugin 0.0.46 and earlier allowed low-privileged Jenkins users with Overall/Read access to trigger connections to attacker-chosen URLs. If they also knew a Jenkins credentials ID, they could cause Jenkins to expose stored credentials to that destination. Exposure is limited to Jenkins instances running mabl Plugin 0.0.46 or earlier where untrusted users have Overall/Read permission and credentials IDs can be learned or inferred. Treat this as high priority where Jenkins stores production, cloud, deployment, or source-control credentials. The business risk is credential theft from CI/CD infrastructure, not only plugin malfunction. Mitigation focus: Inventory Jenkins instances for mabl Plugin 0.0.46 or earlier.; Check Jenkins vendor guidance for the corrected plugin version or official mitigation.; Restrict Overall/Read access to trusted Jenkins users only..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.