Every CVE Search/ Get API key

CVE-2023-30513

Jenkins Kubernetes Plugin does not properly mask credentials

7.5 HighFix available

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.50%Up 0.5 points since Apr 13, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
CVE-2023-30513
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
CVE List 7.5

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
CVE-2023-30513
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
EUVDEUVD-2023-1395 7.5

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
EUVD-2023-1395
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5hq-cqqr-6w4g 4.3

Jenkins Kubernetes Plugin does not properly mask credentials

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

  • The credentials are printed in build steps executing on an agent (typically inside a node block).

  • Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

  • Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

  • Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

  • Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

  • Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
Record
GHSA-v5hq-cqqr-6w4g
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02
OSVAZL-112988 7.5

CVE-2023-30513 affecting package kubernetes 1.30.10-32

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
AZL-112988
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-10
OSVAZL-113000 7.5

CVE-2023-30513 affecting package python-kubernetes 29.0.0-2

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
AZL-113000
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-10
OSV 7.5

Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Record
CVE-2023-30513
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-v5hq-cqqr-6w4g 4.3

Jenkins Kubernetes Plugin does not properly mask credentials

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

  • The credentials are printed in build steps executing on an agent (typically inside a node block).

  • Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

  • Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

  • Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

  • Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

  • Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

  • Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
Record
GHSA-v5hq-cqqr-6w4g
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-319
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.csanchez.jenkins.plugins:kubernetes
Maven
 before 3910.ve59cec5e33ea
3910.ve59cec5e33ea
kubernetes
Azure Linux:3
 through 1.30.10-32 None known
python-kubernetes
Azure Linux:3
 through 29.0.0-2 None known
org.csanchez.jenkins.plugins:kubernetes
Maven
 before 3910.ve59cec5e33ea, plus listed versions
0.10.100.110.120.2
Show 45 moreShow less
0.30.40.4.10.50.60.70.80.91.01.11.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.12.01.12.11.12.21.12.31.12.41.12.51.12.61.12.71.12.81.12.91.13.01.13.11.13.21.13.31.13.41.13.51.13.61.13.71.13.81.13.91.14.01.14.11.14.21.14.31.14.41.14.51.14.6
3910.ve59cec5e33ea

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30513 is a high vulnerability (CVSS 7.5) in Jenkins Kubernetes, published April 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in org.csanchez.jenkins.plugins:kubernetes 3910.ve59cec5e33ea.

References

This page doesn't list everything

Left out here: 179 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open