CVE-2020-2126: Jenkins Digitalocean

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.

Affected products

• Jenkins Digitalocean: up to and including 1.1

Published 2020-02-12. Last modified 2026-06-17.