CVE-2025-64143
mediumpriority · track · 0OT risk · elevatedEPSS 0.002 · 9 %ileDEEUUSEPSS · scored 2026-10-27
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (14)
Products and version ranges known to be affected.
- Jenkins Jenkins ByteGuard Build Actions Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin
- Jenkins Jenkins Curseforge Publisher Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:curseforge_publisher_plugin
- Jenkins Jenkins Eggplant Runner Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:eggplant_runner_plugin
- Jenkins Jenkins Extensible ChoicParameter Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin
- Jenkins Jenkins Nexus Task Runner Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:nexus_task_runner_plugin
- Jenkins Jenkins OpenShift Pipeline Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:openshift_pipeline_plugin
- Jenkins Jenkins Publish to Bitbucket Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin
- Jenkins Jenkins Start WindockContainers Pluginall versionscert_bundDEcpe:/a:cloudbees:jenkins:start_windockcontainers_plugin
- Maven com.openshift.jenkins:openshift-pipeline≤ 1.0.57osvUSpkg:maven/com.openshift.jenkins/openshift-pipeline
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-2443Jenkins Plugins: Mehrere SchwachstellenDeutsch2025-10-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und serverseitige Request-Forgery durchzuführen
- GHSA-4653-9q2r-684qJenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files2025-10-29ghsa · osvUS
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-64143cnnvd
- https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553cnnvd
- https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553enisa_euvd
- http://www.openwall.com/lists/oss-security/2025/10/29/2nvd
- https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan