Read the docs
TI-2023-14349 Aliases CVE-2023-30514GHSA-gmxm-pr58-v5jc

Cleartext transmission of sensitive information in Jenkins Azure Key Vault Plugin

Priority LOW 39CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-319.

Summary

Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:azure-keyvault (Maven): 188.vf46b

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Azure Key Vault Pluginup to 187.va_cd5fecd198a_—No fix listedCNA
—org.jenkins-ci.plugins:azure-keyvault (Maven)before 188.vf46b188.vf46bPatch availableGHSA-gmxm-pr58-v5jc
  • Jenkins Azure Key Vault Plugin VendorJenkins Affected up to 187.va_cd5fecd198a_ Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:azure-keyvault (Maven) Vendor— Affected before 188.vf46b Fixed in 188.vf46b Patch available GHSA-gmxm-pr58-v5jc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:azure_key_vault:*:*:*:*:*:jenkins:*:*up to 187.va_cd5fecd198aVulnerableJenkins
  • cpe:2.3:a:jenkins:azure_key_vault:*:*:*:*:*:jenkins:*:* Versions up to 187.va_cd5fecd198a Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-gmxm-pr58-v5jc org.jenkins-ci.plugins:azure-keyvault (Maven) Fixed in 188.vf46b Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30514
  2. 2026-10-03 Alias added: GHSA-gmxm-pr58-v5jc

References

Advisory 3

  • TI-2020-02190 Missing authorization in Jenkins Azure Key Vault Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences