Jenkins HashiCorp Vault Plugin Exposure of System-Scoped Vault Credentials Vulnerability

A vulnerability exists in the HashiCorp Vault Plugin for Jenkins, specifically in versions through 371.v884a_4dd60fb_6. The plugin fails to set the correct context for looking up Vault credentials, which allows attackers with Item/Configure permission to access and potentially capture Vault credentials they should not have access to.

Impact

Exploitation of this vulnerability could lead to unauthorized access to Vault credentials, allowing attackers to capture sensitive information or credentials they are not entitled to.