Read the docs
TI-2022-08899 Aliases CVE-2022-25186GHSA-fm6q-97gw-c4wh

Protection mechanism failure in Jenkins HashiCorp Vault Plugin

Priority LOW 30CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Why it matters now

EPSS 0.00809 57th percentileScored 2026-11-07
Fix Fixed com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven): 336.v182c0fbaaeb7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins HashiCorp Vault Pluginup to 3.8.0—No fix listedCNA
—com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven)before 336.v182c0fbaaeb7336.v182c0fbaaeb7Patch availableGHSA-fm6q-97gw-c4wh
  • Jenkins HashiCorp Vault Plugin VendorJenkins Affected up to 3.8.0 Fixed in — No fix listed CNA
  • com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven) Vendor— Affected before 336.v182c0fbaaeb7 Fixed in 336.v182c0fbaaeb7 Patch available GHSA-fm6q-97gw-c4wh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:hashicorp_vault:*:*:*:*:*:jenkins:*:*up to 3.8.0VulnerableJenkins
  • cpe:2.3:a:jenkins:hashicorp_vault:*:*:*:*:*:jenkins:*:* Versions up to 3.8.0 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-fm6q-97gw-c4wh com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven) Fixed in 336.v182c0fbaaeb7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25186
  2. 2026-10-03 Alias added: GHSA-fm6q-97gw-c4wh

References

Advisory 2

Other 1

  • TI-2023-16189 Sensitive information in log files in Jenkins HashiCorp Vault Plugin CVSS 3.1HIGH 7.5
  • TI-2022-07278 Insufficiently protected credentials in Jenkins HashiCorp Vault Plugin CVSS 3.1MEDIUM 6.5
  • TI-2022-17103 Missing authorization in Jenkins HashiCorp Vault Plugin CVSS 3.1MEDIUM 6.5
  • TI-2022-08910 Protection mechanism failure in Jenkins HashiCorp Vault Plugin CVSS 3.1MEDIUM 6.5
  • TI-2025-41385 Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the… CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences