Sounds like a bug if true. No known workaround.

Checked in functional tests and could not reproduce for either freestyle or Pipeline builds.

I am able to reproduce this issue.  I will post more details in the next comment.

I get this problem with the following environment:

Jenkins server: runs on `jenkins/jenkins:lts` docker image (image id: 5907903170ad), with Jenkins version 2.150.1. 
Credentials-binding-plugin version: 1.17. 
Agent: runs on a Alpine Linux 3.8 docker image

When running the following pipeline:

pipeline {
    agent { docker { image 'alpine:3.8' } }
    stages {
        stage('run_for_ranapas') {
            steps {
                withCredentials([usernamePassword(credentialsId: 'quote_pw', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
                    sh '''
                        echo $USER $PASS
                    '''
                }
            }
        }
    }
}

Where `quote_pw` is a global scope, global domain credential who's `kind` is `username and password`, and who's values are: username: `username7`, password: `password'7`.

The result is 

[Pipeline] withCredentials
[Pipeline] {
[Pipeline] sh
+ echo **** 'password'"'"'7'
**** ****

Ah yes, this is just Bash being too clever. When you have echo enabled, Bash—but not, say, Ubuntu’s more compliant Dash—will detect command arguments containing ' and present a mockup of a command line that would escape them even if all the mockup elements were manually surrounded with '. Thus

echo $USER $PASS

is rendered as

+ echo username7 password'"'"'7

rather than simply

+ echo username7 password'7

which I suppose is intended to make it easier for you to copy-paste this line into a new script as

echo 'username7' 'password'"'"'7'

Since output does not literally contain the password, it is not masked. In general, the plugin cannot keep up with the ways in which various tools might decide to mangle secrets before printing them; it keeps it simple and masks secrets only when printed literally.

So either disable echoing with

set +x

or simply avoid passwords with shell metacharacters, ' especially.

jglick, can you at least include a note about this in the documentation?

Done.

cowlinator jamclean FYI we updated the different patterns used in credentials-binding to support "common" quotation schema by sh/bash/batch/powershell since 1.19.