Jenkins Continuous Integration Engine

Jenkins Redpen - Pipeline to Jira: Path Validation Flaw <1.054, File Read
CVE-2025-67643 4.3 - Medium - December 10, 2025

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Directory traversal

Jenkins Vault Plugin CVE-2025-67642: Context Miss for Vault Cred Leak
CVE-2025-67642 4.3 - Medium - December 10, 2025

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Improper Ownership Management

cmd injection via unescaped workspace path in Jenkins Git Client Plugin pre-6.4
CVE-2025-67640 5 - Medium - December 10, 2025

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Shell injection

Jenkins Coverage Plugin XSS via REST API ID unvalidated (before 2.3054)
CVE-2025-67641 8 - High - December 10, 2025

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

XSS

Jenkins 2.540+ Build Auth Token Leak via Job Config Form
CVE-2025-67638 4.3 - Medium - December 10, 2025

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Cleartext Storage of Sensitive Information

Jenkins CSRF in 2.540 & LTS 2.528.2 (CVE202567639)
CVE-2025-67639 3.5 - Low - December 10, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Session Riding

Jenkins <=2.540: build auth tokens plaintext in config.xml (Item/Ext Read)
CVE-2025-67637 4.3 - Medium - December 10, 2025

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Cleartext Storage of Sensitive Information

Jenkins <2.540: View/Read Users Leaking Encrypted Passwords
CVE-2025-67636 4.3 - Medium - December 10, 2025

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

AuthZ

Jenkins CLI HTTP DDOS CVE-2025-67635
CVE-2025-67635 7.5 - High - December 10, 2025

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

Improper Resource Shutdown or Release

Jenkins Publish-to-Bitbucket Plugin <0.4 RCE via Missing Permission Check
CVE-2025-64150 5.4 - Medium - October 29, 2025

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

AuthZ

CSRF in Jenkins Publish_to_Bitbucket Plugin 0.4 Captures Credentials
CVE-2025-64149 5.4 - Medium - October 29, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Session Riding

Jenkins Publish to Bitbucket Plugin 0.4 enum creds IDs via absent perm check
CVE-2025-64148 4.3 - Medium - October 29, 2025

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

AuthZ

Jenkins Curseforge Publisher Plugin 1.0 API Key Disclosure
CVE-2025-64147 4.3 - Medium - October 29, 2025

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Missing Encryption of Sensitive Data

Jenkins Curseforge Publisher 1.0 exfiltrates unencrypted API Keys in config.xml
CVE-2025-64146 4.3 - Medium - October 29, 2025

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Jenkins BBA Plugin 1.0 API Tokens Unmasked in Job Config Form
CVE-2025-64145 4.3 - Medium - October 29, 2025

Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Missing Encryption of Sensitive Data

Jenkins ByteGuard Build Actions Plugin 1.0 API token disclosure via config.xml
CVE-2025-64144 4.3 - Medium - October 29, 2025

Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Unencrypted Auth Tokens Stored in Jenkins OpenShift Pipeline Plugin 1.0.57
CVE-2025-64143 4.3 - Medium - October 29, 2025

Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Privilege Escalation: Jenkins Nexus Task Runner Plugin <0.9.3 missing permission check
CVE-2025-64142 4.3 - Medium - October 29, 2025

A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

AuthZ

CSRF in Jenkins Nexus Task Runner Plugin <=0.9.2 Allows Remote URL Connect
CVE-2025-64141 4.3 - Medium - October 29, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Session Riding

Jenkins Azure CLI Plugin v0.9: Arbitrary Shell Cmd Exec
CVE-2025-64140 8.8 - High - October 29, 2025

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.

Shell injection

Missing Permission Check in Jenkins Start Windocks Containers Plugin <=1.4
CVE-2025-64139 4.3 - Medium - October 29, 2025

A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

AuthZ

Jenkins Themis Plugin <=1.4.1 RCE via Missing Permission Check
CVE-2025-64137 4.3 - Medium - October 29, 2025

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

AuthZ

Jenkins Start Windocks Containers Plugin CSRF before 1.4
CVE-2025-64138 4.3 - Medium - October 29, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

Session Riding

Jenkins Themis Plugin 1.4.1 CSRF allows remote HTTP server connectivity
CVE-2025-64136 4.3 - Medium - October 29, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

Session Riding

Jenkins JDepend Plugin up to 1.3.1 XXE via outdated JDepend Maven Plugin
CVE-2025-64134 7.1 - High - October 29, 2025

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

XXE

Jenkins Eggplant Runner Plug <=0.0.1.301 jdk.http.auth.tunneling.disabledSchemes
CVE-2025-64135 5.9 - Medium - October 29, 2025

Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.

Insecure Default Initialization of Resource

CSRF in Jenkins Extensible Choice Parameter Plugin Enables Groovy Execution
CVE-2025-64133 5.4 - Medium - October 29, 2025

A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.

Session Riding

Jenkins SAML Plugin <4.583 Replay Attack via Missing Replay Cache
CVE-2025-64131 7.5 - High - October 29, 2025

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

Authentication Bypass by Capture-replay

Jenkins MCP Server Plugin 0.84 Improper Permission Checks
CVE-2025-64132 5.4 - Medium - October 29, 2025

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

AuthZ

Jenkins 2.527/LTS 2.516.2: Log Injection via Unrestricted Char in Log Msg
CVE-2025-59476 5.3 - Medium - September 17, 2025

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Improper Output Neutralization for Logs

Jenkins 2.527 & LTS 2.516.2 Authenticated-User Profile Dropdown Bypass
CVE-2025-59475 4.3 - Medium - September 17, 2025

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

AuthZ

Jenkins <=2.527 LTS: Sidepanel Exec Widget Auth Bypass (CVE-2025-59474)
CVE-2025-59474 5.3 - Medium - September 17, 2025

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

AuthZ

Jenkins OpenTelemetry Plugin: Missing Permission Check (3.1543) Credential Exposure
CVE-2025-58460 4.2 - Medium - September 03, 2025

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

AuthZ

Jenkins global-build-stats Plugin REST API bypass allows ID enumeration
CVE-2025-58459 4.3 - Medium - September 03, 2025

Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

Authorization

Jenkins Git Client Plugin 6.3.2 LFI via amazons3 URL Validation (Read)
CVE-2025-58458 4.3 - Medium - September 03, 2025

In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Insertion of Sensitive Information into Externally-Accessible File or Directory

Jenkins Xooa Plugin 0.0.7 and earlier: Unmasked Deployment Token
CVE-2025-53677 5.3 - Medium - July 09, 2025

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.

Unprotected Storage of Credentials

Git Parameter Plugin Unvalidated Input Enables Arbitrary Git Parameters
CVE-2025-53652 8.2 - High - July 09, 2025

Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.

Improper Input Validation

Jenkins Apica Loadtest Plugin <=1.10 Token Leak via config.xml
CVE-2025-53664 6.5 - Medium - July 09, 2025

Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Unprotected Storage of Credentials

Jenkins Nouvola DiveCloud Plug 1.08 – API Keys Stored Unencrypted
CVE-2025-53670 6.5 - Medium - July 09, 2025

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Cleartext Storage of Sensitive Information

CVE-2025-53650: Jenkins Credentials Binding Plugin leaks passwords in logs
CVE-2025-53650 7.3 - High - July 09, 2025

Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.

Unencrypted API Key Leak in Jenkins Kryptowire Plugin <0.3
CVE-2025-53672 6.5 - Medium - July 09, 2025

Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

Cleartext Storage of Sensitive Information

Jenkins Sensedia API PT Plugin 1.0 Token Unencrypted in Global Config
CVE-2025-53673 6.5 - Medium - July 09, 2025

Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Jenkins Sensedia API Platform Tools Plugin 1.0 token disclosure
CVE-2025-53674 5.3 - Medium - July 09, 2025

Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.

Unprotected Storage of Credentials

Unencrypted Applitools keys stored by Jenkins Applitools Eyes Plugin <=1.16.5
CVE-2025-53742 6.5 - Medium - July 09, 2025

Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Cleartext Storage of Sensitive Information

Jenkins VAddy Plugin <=1.2.8: Auth Keys Exposed in UI (Info Disclosure)
CVE-2025-53669 4.3 - Medium - July 09, 2025

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Unprotected Storage of Credentials

Jenkins VAddy Plugin 1.2.8-: Unencrypted API Keys Stored in Config XML
CVE-2025-53668 6.5 - Medium - July 09, 2025

Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Jenkins Applitools Eyes Plugin <=1.16.5 Reveals API Keys
CVE-2025-53743 5.3 - Medium - July 09, 2025

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Insufficiently Protected Credentials

Jenkins Nouvola DiveCloud Plugin <=1.08 leaks API keys - info disclosure
CVE-2025-53671 6.5 - Medium - July 09, 2025

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Unprotected Storage of Credentials

Jenkins Xooa Plugin <=0.0.7 stores token unencrypted
CVE-2025-53676 6.5 - Medium - July 09, 2025

Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

Missing Encryption of Sensitive Data

Jenkins Warrior Framework Plugin <=1.2: Passwords stored unencrypted in config
CVE-2025-53675 6.5 - Medium - July 09, 2025

Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Unprotected Storage of Credentials