CVE-2021-21664: Jenkins Xebialabs Xl Deploy

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

Affected products

• Jenkins Xebialabs Xl Deploy: up to and including 10.0.1

Published 2021-06-10. Last modified 2026-06-17.