CVE-2022-36888: Jenkins Hashicorp Vault

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.

Affected products

• Jenkins Hashicorp Vault: up to and including 354.vdb_858fd6b_f48

Published 2022-07-27. Last modified 2026-06-17.