CVE-2017-1000087

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

• CWE-200

• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory
• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000081Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated…9.8
• CVE-2017-1000082systemd v233 and earlier fails to safely parse usernames sta…9.8
• CVE-2017-1000083backend/comics/comics-document.c (aka the comic book backend…
• CVE-2017-1000084Parameterized Trigger Plugin fails to check Item/Build permi…
• CVE-2017-1000085Subversion Plugin connects to a user-specified Subversion re…
• CVE-2017-1000086The Periodic Backup Plugin did not perform any permission ch…
• CVE-2017-1000088The Sidebar Link plugin allows users able to configure jobs,…
• CVE-2017-1000089Builds in Jenkins are associated with an authentication that…
• CVE-2017-1000090Role-based Authorization Strategy Plugin was not requiring r…
• CVE-2017-1000091GitHub Branch Source Plugin connects to a user-specified Git…
• CVE-2017-1000092Git Plugin connects to a user-specified Git repository as pa…
• CVE-2017-1000093Poll SCM Plugin was not requiring requests to its API be sen…