CVE-2019-16556

Root Cause: The Jenkins Rundeck Plugin prior to version 3.6.6 stores credentials in plaintext within its global configuration file and in job config.xml files on the Jenkins master [1][3]. This violates the principle of secure credential storage.

Exploitation: An attacker who has either the Extended Read permission (which allows viewing job configurations) or direct access to the Jenkins master file system can read these unencrypted credentials [1][3]. No additional authentication is required beyond the existing permissions.

Impact: Successful exploitation exposes any credentials configured for use with the Rundeck plugin, such as API tokens or passwords, potentially allowing the attacker to authenticate to external systems managed by Rundeck [1][2].

Mitigation: The issue is fixed in Rundeck Plugin version 3.6.6 [2]. Users should upgrade immediately. As a workaround, restrict Extended Read permissions and limit file system access to trusted administrators only [1].