Jenkins OpenShift Pipeline Plugin Authorization Token Storage Vulnerability

A vulnerability exists in the Jenkins OpenShift Pipeline Plugin in versions through 1.0.57, where authorization tokens are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these tokens. As of the publication of this advisory, no fix is available.

Impact

The vulnerability allows for unauthorized access to authorization tokens, which could be misused to authenticate or interact with OpenShift resources on behalf of the user.