Jenkins's build authorization token is stored and displayed in plain text

GHSA-hxjg-2jvf-h3rx · BIT-jenkins-2025-67638 · CVE-2025-67638

Published Dec 10, 2025 · Modified Feb 4, 2026

Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-67638
WEB https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981
PACKAGE https://github.com/jenkinsci/jenkins
WEB https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes