CVE-2025-67637

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-312

Published

2025-12-10

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• jenkins:jenkins

Packages (OSV)

References

• https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783

Check your stackJSON