CVE-2022-27206

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

• CWE-522

• http://www.openwall.com/lists/oss-security/2022/03/15/2Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/03/15/2Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891Vendor Advisory

Published

Mar 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27200Jenkins Folder-based Authorization Strategy Plugin 1.3 and e…4.8
• CVE-2022-27201Jenkins Semantic Versioning Plugin 1.13 and earlier does not…6.5
• CVE-2022-27202Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c …5.4
• CVE-2022-27203Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c …6.5
• CVE-2022-27204A cross-site request forgery vulnerability in Jenkins Extend…8.8
• CVE-2022-27205A missing permission check in Jenkins Extended Choice Parame…4.3
• CVE-2022-27207Jenkins global-build-stats Plugin 1.5 and earlier does not e…4.8
• CVE-2022-27208Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlie…6.5
• CVE-2022-27209A missing permission check in Jenkins Kubernetes Continuous …6.5
• CVE-2022-2721In affected versions of Octopus Server it is possible for ta…7.5
• CVE-2022-27210A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2022-27211A missing permission check in Jenkins Kubernetes Continuous …6.5