description: A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
affected:
{
product: Jenkins JX Resources Plugin
vendor: Jenkins project
versions:
status: affected, version: 1.0.36 and earlier
}