CVE-2021-21625: Jenkins Cloudbees Aws Credentials

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.

Affected products

• Jenkins Cloudbees Aws Credentials: up to and including 1.28

Published 2021-03-18. Last modified 2026-06-17.