Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2t2v-bwr2-vugu
Vulnerability ID VCID-2t2v-bwr2-vugu
Aliases CVE-2020-2309
GHSA-g2r3-4g8q-h5rj
Summary Missing authorization in Jenkins Kubernetes Plugin Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. An enumeration of credentials IDs in Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 requires the appropriate permissions.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-862 Missing Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2309.json
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2020-2309
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-g2r3-4g8q-h5rj
cvssv3.1 4.3 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2309.json
generic_textual MODERATE https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2309.json
cvssv3.1 4.3 https://github.com/jenkinsci/kubernetes-plugin
generic_textual MODERATE https://github.com/jenkinsci/kubernetes-plugin
cvssv3.1 4.3 https://github.com/jenkinsci/kubernetes-plugin/commit/f26130149c487b1ef8ece9b7b881739c2f8c6736
generic_textual MODERATE https://github.com/jenkinsci/kubernetes-plugin/commit/f26130149c487b1ef8ece9b7b881739c2f8c6736
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-2309
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-2309
cvssv3.1 4.3 https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
generic_textual MODERATE https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2309.json
https://api.first.org/data/v1/epss?cve=CVE-2020-2309
https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2309.json
https://github.com/jenkinsci/kubernetes-plugin
https://github.com/jenkinsci/kubernetes-plugin/commit/f26130149c487b1ef8ece9b7b881739c2f8c6736
https://nvd.nist.gov/vuln/detail/CVE-2020-2309
https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
1895947 https://bugzilla.redhat.com/show_bug.cgi?id=1895947
GHSA-g2r3-4g8q-h5rj https://github.com/advisories/GHSA-g2r3-4g8q-h5rj
RHSA-2021:0034 https://access.redhat.com/errata/RHSA-2021:0034
RHSA-2021:0038 https://access.redhat.com/errata/RHSA-2021:0038
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2309.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2309.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/kubernetes-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/kubernetes-plugin/commit/f26130149c487b1ef8ece9b7b881739c2f8c6736
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-2309
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25337
EPSS Score 0.00089
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:08:15.819556+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g2r3-4g8q-h5rj/GHSA-g2r3-4g8q-h5rj.json 38.0.0