Cleartext storage of sensitive information in Jenkins
Priority LOW 19CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-312.
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Partial Jenkins (Jenkins Project): 2.541, 2.528.3org.jenkins-ci.main:jenkins-core (Maven): 2.541, 2.528.3Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | — | 2.541, 2.528.3 | Patch available | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.529 to before 2.541 | 2.541 | Patch available | GHSA-hxjg-2jvf-h3rx |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.528.3 | 2.528.3 | Patch available | GHSA-hxjg-2jvf-h3rx |
- Jenkins VendorJenkins Affected — Fixed in 2.541, 2.528.3 Patch available CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.529 to before 2.541 Fixed in 2.541 Patch available GHSA-hxjg-2jvf-h3rx
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.528.3 Fixed in 2.528.3 Patch available GHSA-hxjg-2jvf-h3rx
Remediation
- Fix · CNA Jenkins (Jenkins Project) Fixed in 2.541, 2.528.3
- Fix · GHSA-hxjg-2jvf-h3rx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.541 Advisory →
- Fix · GHSA-hxjg-2jvf-h3rx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.528.3 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Jenkins — Jenkins Security Advisory 2025-12-10
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2025-41378 Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI…Priority MEDIUM 40
- TI-2025-41379 Missing authorization in JenkinsPriority LOW 20
- TI-2025-41380 Cleartext storage of sensitive information in JenkinsPriority LOW 19
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67638
- 2026-10-03 Alias added: GHSA-hxjg-2jvf-h3rx
References
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-67638 · CVE Program
- CVE-2025-67638 · NVD
- FIRST EPSS
- GHSA-hxjg-2jvf-h3rx · GitHub Advisory Database · CC BY 4.0
- CVE-2025-67638 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences