Background cache refresh failed

[etherdelta123]

Jenkins and plugins versions report

Environment

We can get the plugin to connect to Password Manager and get the success message "Success! A valid session is active and the plugin is ready to serve credentials."
But credentials never appear and in the docker logs we see:

2026-03-19 05:51:18.713+0000 [id=54]	WARNING	c.m.b.BitwardenCacheManager#lambda$getMetadata$0: Background cache refresh failed.
com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'ERROR': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false')
[LF]>  at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 1]

More logs attached as a file.

[jenkins.log.rtf](https://github.com/user-attachments/files/26107939/jenkins.log.rtf)

What Operating System are you using (both controller, and any agents involved in the problem)?

Just the Jenkins Controller, no agents yet.
It's docker running on Ubuntu Noble.
Jenkins version is 2.541.2.

Reproduction steps

1. Set up plugins settings and run the "Verify Session Status" - we get Success.
2. The credentials never appear and we see the exceptions in docker logs.

Expected Results

I think we should see credentials appearing in the vault.

Actual Results

No credentials appear.

Anything else?

Jenkins: 2.541.2
OS: Linux - 6.8.0-49-generic
Java: 21.0.9 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

ansible:635.v34b_48e979c86
ant:520.vd082ecfb_16a_9
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
asm-api:9.9.1-189.vb_5ef2964da_91
bitwarden-credentials-provider:254.vd33c35d1b_fb_5
bootstrap5-api:5.3.8-895.v4d0d8e47fea_d
bouncycastle-api:2.30.1.83-289.v8426fcd19371
branch-api:2.1280.v0d4e5b_b_460ef
build-timeout:1.40
caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81
checks-api:402.vca_263b_f200e3
cloudbees-folder:6.1079.vc0975c2de294
commons-lang3-api:3.20.0-109.ve43756e2d2b_4
commons-text-api:1.15.0-218.va_61573470393
configuration-as-code:2053.vb_0da_47381a_25
credentials:1491.v6d6145e96e1c
credentials-binding:717.v951d49b_5f3a_a_
customizable-header:292.v401b_17c12e68
dark-theme:574.va_19f05d54df5
dashboard-view:2.558.v96b_901978e47
display-url-api:2.217.va_6b_de84cc74b_
durable-task:664.v2b_e7a_dfff66c
echarts-api:6.0.0-1165.vd1283a_3e37d4
eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
email-ext:1933.v45cec755423f
flatpickr-api:4.6.13-32.v60a_51029c136
font-awesome-api:7.2.0-965.ve3840b_696418
git:5.10.0
git-client:6.5.0
github:1.46.0
github-api:1.330-492.v3941a_032db_2a_
github-branch-source:1967.vdea_d580c1a_b_a_
gradle:2.18.1203.v2c96b_1243c72
gson-api:2.13.2-173.va_a_092315913c
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
jackson2-api:2.21.1-428.vf8dd988fa_d8d
jackson3-api:3.1.0-64.v37e742c35905
jakarta-activation-api:2.1.4-1
jakarta-mail-api:2.1.5-1
jakarta-xml-bind-api:4.0.6-12.vb_1833c1231d3
javax-activation-api:1.2.0-8
jaxb:2.3.9-143.v5979df3304e6
jjwt-api:0.11.5-120.v0268cf544b_89
joda-time-api:2.14.1-187.vdf2def02b_8a_1
jquery3-api:3.7.1-619.vdb_10e002501a_
json-api:20251224-185.v0cc18490c62c
json-path-api:3.0.0-218.vcd4dd1355de2
jsoup:1.22.1-76.v9cdb_2456c0e3
junit:1403.vd9d1413fd205
ldap:807.v7d7de30930cf
mailer:525.v2458b_d8a_1a_71
matrix-auth:3.2.9
matrix-project:870.v9db_fcfc2f45b_
metrics:4.2.37-494.v06f9a_939d33a_
mina-sshd-api-common:2.16.0-167.va_269f38cc024
mina-sshd-api-core:2.16.0-167.va_269f38cc024
okhttp-api:5.3.2-200.vedb_720a_cf1f8
pipeline-build-step:584.vdb_a_2cc3a_d07a_
pipeline-github-lib:65.v203688e7727e
pipeline-graph-view:803.vb_88f7a_a_1cb_47
pipeline-groovy-lib:787.ve2fef0efdca_6
pipeline-input-step:540.v14b_100d754dd
pipeline-milestone-step:138.v78ca_76831a_43
pipeline-model-api:2.2277.v00573e73ddf1
pipeline-model-definition:2.2277.v00573e73ddf1
pipeline-model-extensions:2.2277.v00573e73ddf1
pipeline-stage-step:322.vecffa_99f371c
pipeline-stage-tags-metadata:2.2277.v00573e73ddf1
plain-credentials:199.v9f8e1f741799
plugin-util-api:6.1192.v30fe6e2837ff
prism-api:1.30.0-703.v116fb_3b_5b_b_a_a_
resource-disposer:0.25
role-strategy:848.va_a_ea_673cf0b_c
scm-api:728.vc30dcf7a_0df5
script-security:1399.ve6a_66547f6e1
snakeyaml-api:2.5-149.v72471e9c6371
snakeyaml-engine-api:3.0.1-5.vd98ea_ff3b_92e
ssh-credentials:361.vb_f6760818e8c
ssh-slaves:3.1097.v868116049892
structs:362.va_b_695ef4fdf9
theme-manager:344.vd7b_e20e046dc
thinBackup:2.1.3
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.284.v1974ea_324382
variant:70.va_d9f17f859e0
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1398.v67030756d3fb_
workflow-basic-steps:1098.v808b_fd7f8cf4
workflow-cps:4259.vf653c2b_8a_b_69
workflow-durable-task-step:1464.v2d3f5c68f84c
workflow-job:1571.vb_423c255d6d9
workflow-multibranch:821.vc3b_4ea_780798
workflow-scm-step:466.va_d69e602552b_
workflow-step-api:710.v3e456cc85233
workflow-support:1015.v785e5a_b_b_8b_22
ws-cleanup:0.49

Are you interested in contributing a fix?

No response

[etherdelta123]

jenkins.log.rtf

[mwdle]

@etherdelta123
What is your system architecture, x86? ARM? something else?

What installation method did you use for the Bitwarden CLI? What version of the CLI are you using? Have you tried updating it?

Just to make sure, you are attempting to authenticate using a Bitwarden API Key and not just a regular username + password, is that correct?

Based on the log output you provided, when the plugin executes the command bw list items, the text "ERROR" is returned, instead of the JSON list of items. The reason for this is not yet clear.

[etherdelta123]

It's docker on ubuntu noble. Docker is Debian GNU/Linux 13 (trixie) - jenkins/jenkins:lts.
All x86.
I think bw came with the plugin as it was located at /var/jenkins_home/bitwarden-credentials-provider-data/bin/bw.
Version 2026.2.0.
I copied it to /usr/local/bin just in case.
Am using an API token.
cheers!

[etherdelta123]

I meant API key, as generated in BW GUI.

[mwdle]

A few more questions:

• Are you using the official Bitwarden server? or a self hosted Vaultwarden instance?
• Did you ever have this plugin working previously?
• Are you using the latest version of this plugin, 254.vd33c35d1b_fb_5?

Would you be willing to try manually installing Bitwarden CLI 2026.1.0 in the Jenkins controller container and report back whether it has any effect? For your specific environment, @etherdelta123, you can accomplish that by extracting bw-linux-2026.1.0.zip and overwriting the bw executable in your container at the path you mentioned previously:

/var/jenkins_home/bitwarden-credentials-provider-data/bin/bw

[etherdelta123]

By the way, this is low priority so please don't feel that you need to rush.
We're running a self-hosted BW site with these containers of version 2026.2.1.
This is the first time I've used this plugin.
Version: Bitwarden Credentials Provider Version 254.vd33c35d1b_fb_5 which seems to be the latest.
Tried with bw 2026.1.0 but still the same:
From GUI:
Bitwarden CLI Management
Currently installed version: 2026.1.0

Logs:
2026-03-20 06:48:07.258+0000 [id=25] INFO c.m.bitwarden.cli.BitwardenCLI#login: Logging in with API key credentials. 2026-03-20 06:48:13.150+0000 [id=25] INFO c.m.bitwarden.cli.BitwardenCLI#login: Login successful. 2026-03-20 06:48:13.151+0000 [id=25] INFO c.m.bitwarden.cli.BitwardenCLI#unlock: Unlocking vault. 2026-03-20 06:48:18.573+0000 [id=25] INFO c.m.bitwarden.cli.BitwardenCLI#sync: Syncing vault. 2026-03-20 06:48:22.802+0000 [id=25] INFO c.m.bitwarden.cli.BitwardenCLI#sync: Vault sync complete. 2026-03-20 06:48:31.776+0000 [id=25] WARNING c.g.c.cache.LocalCache$Segment#lambda$loadAsync$0: Exception thrown during refresh com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'ERROR': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false') [LF]> at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATIONdisabled); line: 1, column: 1]

Thanks!

[mwdle]

I didn't even realize Bitwarden provides an official way to self host 😅 I'll give that a go when I get a chance and see if I can replicate the issue.

In the meantime, would you mind performing a few more diagnostic steps to rule out that this is unrelated to your self hosted BW instance or the BW CLI itself @etherdelta123 ? The commands are as follows:

1. docker exec -it <YOUR_JENKINS_CONTAINER_NAME> bash

2. cd /var/jenkins_home/bitwarden-credentials-provider-data/bin

3. ./bw config server <YOUR_BW_SERVER_URL>

4. ./bw login --apikey (follow the interactive prompt and enter your clientid/client secret)

5. ./bw unlock (follow the interactive prompt and enter your master password)

   This step will cause the CLI to return an export BW_SESSION command, including your session key. Copy and paste the relevant entry to save the required environment variable.

6. ./bw list items (you should see a long JSON string containing your vault items if it succeeds)

Based on the logs you provided previously, the plugin is failing at step 6. Please report back with the result of step 6 if it fails. If it succeeds, obviously you should not share the result because it contains secrets or sensitive information.

If you have any questions about the steps feel free to post them here or consult the Official Bitwarden CLI Documentation.

Thank you 🙂

[etherdelta123]

Sorry for delay, vacation ;)
Here's the output showing errors at the start then from passwordHistory there is a lot of what looks to be valid data from bitwarden.

ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

[EncString Generic Decrypt] failed to decrypt encstring. Context: Property: fileName; ObjectContext: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4 Error [CryptoError]: The decryption operation failed
    at __wbg_new_122699422a56c70d (/snapshot/clients/apps/cli/build/bw.js:5866:21)
    at wasm://wasm/015b1236:wasm-function[6713]:0x39a09d
    at wasm://wasm/015b1236:wasm-function[2050]:0x2f381b
    at wasm://wasm/015b1236:wasm-function[4021]:0x362504
    at wasm://wasm/015b1236:wasm-function[2679]:0x32b53e
    at PureCrypto.symmetric_decrypt_string (/snapshot/clients/apps/cli/build/bw.js:4404:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:55609:67)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55562:58) {
  variant: 'Decrypt'
}
ERROR bitwarden_crypto::store::context: error=The decryption operation failed`

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_122699422a56c70d (/snapshot/clients/apps/cli/build/bw.js:5866:21)
    at wasm://wasm/015b1236:wasm-function[6713]:0x39a09d
    at wasm://wasm/015b1236:wasm-function[2050]:0x2f381b
    at wasm://wasm/015b1236:wasm-function[3567]:0x354095
    at wasm://wasm/015b1236:wasm-function[767]:0x214dda
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:4148:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:55708:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55562:58) {
  variant: 'Decrypt'
}
ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

[EncString Generic Decrypt] failed to decrypt encstring. Context: Property: fileName; ObjectContext: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4 Error [CryptoError]: The decryption operation failed
    at __wbg_new_122699422a56c70d (/snapshot/clients/apps/cli/build/bw.js:5866:21)
    at wasm://wasm/015b1236:wasm-function[6713]:0x39a09d
    at wasm://wasm/015b1236:wasm-function[2050]:0x2f381b
    at wasm://wasm/015b1236:wasm-function[4021]:0x362504
    at wasm://wasm/015b1236:wasm-function[2679]:0x32b53e
    at PureCrypto.symmetric_decrypt_string (/snapshot/clients/apps/cli/build/bw.js:4404:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:55609:67)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55562:58) {
  variant: 'Decrypt'
}
ERROR bitwarden_crypto::store::context: error=The decryption operation failed

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_122699422a56c70d (/snapshot/clients/apps/cli/build/bw.js:5866:21)
    at wasm://wasm/015b1236:wasm-function[6713]:0x39a09d
    at wasm://wasm/015b1236:wasm-function[2050]:0x2f381b
    at wasm://wasm/015b1236:wasm-function[3567]:0x354095
    at wasm://wasm/015b1236:wasm-function[767]:0x214dda
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:4148:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:55708:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55562:58) {
  variant: 'Decrypt'
}
[{"passwordHistory":[]..... removed

[mwdle]

Likewise, sorry for the delays! This has been very helpful so thank you for bearing with me.

It looks like the root cause is a cryptographic error with a specific item in your vault. The CLI is failing to decrypt an attachment on the item with Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4. You may want to check on that item, although the error could also be caused by a bug in the Bitwarden Server or CLI itself.

That being said, this plugin probably shouldn't crash when such an error occurs. I'm planning an update to address this, as there are a few ways this plugin's interactions with the Bitwarden CLI can be improved. I would greatly appreciate some more diagnostic help though, as I have not been able to replicate the error so far.

Would you be willing to repeat the experiment described in my last message, with a twist? When you get to step 6, please run it two more times:

• ./bw list items --raw (Let me know if the error is suppressed or if it still prints)
• ./bw list items --response (Let me know if the error gets cleanly wrapped in a JSON object, or if still prints out before the valid output)

[etherdelta123]

They return the following respectively. After the snip is what looks like valid data from bit warden.

bw list items --raw

ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

Failed to decrypt property 'fileName' of domain. Context: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4. Error: The decryption operation failed
ERROR bitwarden_crypto::store::context: error=The decryption operation failed

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_2d996564533475e2 (/snapshot/clients/apps/cli/build/bw.js:5530:21)
    at wasm://wasm/0164757e:wasm-function[7081]:0x3be4ae
    at wasm://wasm/0164757e:wasm-function[2135]:0x30e482
    at wasm://wasm/0164757e:wasm-function[3742]:0x374a7e
    at wasm://wasm/0164757e:wasm-function[798]:0x2145a7
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:3465:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:56018:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55872:58) {
  variant: 'Decrypt'
}
ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

Failed to decrypt property 'fileName' of domain. Context: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4. Error: The decryption operation failed
ERROR bitwarden_crypto::store::context: error=The decryption operation failed

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_2d996564533475e2 (/snapshot/clients/apps/cli/build/bw.js:5530:21)
    at wasm://wasm/0164757e:wasm-function[7081]:0x3be4ae
    at wasm://wasm/0164757e:wasm-function[2135]:0x30e482
    at wasm://wasm/0164757e:wasm-function[3742]:0x374a7e
    at wasm://wasm/0164757e:wasm-function[798]:0x2145a7
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:3465:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:56018:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55872:58) {
  variant: 'Decrypt'
}
Event post failed.
[{"passwordHistory”:[]…<snip>

bw list items --response

ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

Failed to decrypt property 'fileName' of domain. Context: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4. Error: The decryption operation failed
ERROR bitwarden_crypto::store::context: error=The decryption operation failed

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_2d996564533475e2 (/snapshot/clients/apps/cli/build/bw.js:5530:21)
    at wasm://wasm/0164757e:wasm-function[7081]:0x3be4ae
    at wasm://wasm/0164757e:wasm-function[2135]:0x30e482
    at wasm://wasm/0164757e:wasm-function[3742]:0x374a7e
    at wasm://wasm/0164757e:wasm-function[798]:0x2145a7
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:3465:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:56018:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55872:58) {
  variant: 'Decrypt'
}
ERROR bitwarden_crypto::enc_string::symmetric: error=The decryption operation failed

Failed to decrypt property 'fileName' of domain. Context: DomainType: Attachment; Cipher Id: c1345f88-64e0-4f9f-a10b-b1e3004ff4f4. Error: The decryption operation failed
ERROR bitwarden_crypto::store::context: error=The decryption operation failed

[Attachment] Error decrypting attachment Error [CryptoError]: The decryption operation failed
    at __wbg_new_2d996564533475e2 (/snapshot/clients/apps/cli/build/bw.js:5530:21)
    at wasm://wasm/0164757e:wasm-function[7081]:0x3be4ae
    at wasm://wasm/0164757e:wasm-function[2135]:0x30e482
    at wasm://wasm/0164757e:wasm-function[3742]:0x374a7e
    at wasm://wasm/0164757e:wasm-function[798]:0x2145a7
    at PureCrypto.unwrap_symmetric_key (/snapshot/clients/apps/cli/build/bw.js:3465:18)
    at EncryptServiceImplementation.<anonymous> (/snapshot/clients/apps/cli/build/bw.js:56018:90)
    at Generator.next (<anonymous>)
    at fulfilled (/snapshot/clients/apps/cli/build/bw.js:55872:58) {
  variant: 'Decrypt'
}
Event post failed.
{"success":true,"data":{"object":"list","data":[{"passwordHistory”:[]…<snip>