CVE-2021-21643: Jenkins Config File Provider

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

Affected products

• Jenkins Config File Provider: up to and including 3.7.0

Published 2021-04-21. Last modified 2026-06-17.