CVE-2025-64135: Jenkins Eggplant Runner Auth Bypass Flaw

CVE-2025-64135 Overview

CVE-2025-64135 affects the Jenkins Eggplant Runner Plugin version 0.0.1.301.v963cffe8ddb_8 and earlier. The plugin sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value at runtime. This action disables a Java runtime protection mechanism that blocks Basic authentication schemes over HTTPS tunnels through HTTP proxies. Attackers positioned on the network can exploit the weakened configuration to intercept credentials transmitted through proxy tunnels. The issue is categorized under [CWE-1188] Initialization of a Resource with an Insecure Default.

Critical Impact
The plugin removes a Java default that protects proxied HTTPS traffic. Credentials sent through affected Jenkins agents can be exposed to man-in-the-middle attackers.

Affected Products

Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier
Jenkins controllers loading the vulnerable plugin
Jenkins build environments configured to use HTTPS through HTTP proxies

Discovery Timeline

2025-10-29 - Jenkins publishes Security Advisory SECURITY-3326
2025-10-29 - CVE-2025-64135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64135

Vulnerability Analysis

The Java runtime maintains a set of authentication schemes that it refuses to send when tunneling HTTPS through an HTTP proxy using the CONNECT method. The property jdk.http.auth.tunneling.disabledSchemes defaults to Basic, blocking the client from transmitting plaintext Base64 credentials to a proxy that could be attacker-controlled or observed.

The Eggplant Runner Plugin explicitly sets this property to an empty string during plugin initialization. This global change affects the entire Jenkins Java Virtual Machine (JVM), not only the plugin's own HTTP calls. Any code running in the same JVM that performs proxied HTTPS requests loses the safeguard.

Exploitation requires a network attacker capable of observing or manipulating proxy traffic between Jenkins and a target HTTPS endpoint. The complexity is elevated because the attacker must be positioned on the proxy path, which limits opportunistic abuse.

Root Cause

The root cause is an insecure configuration change performed at plugin load time. The plugin overrides a security-relevant JVM default without scoping the override to a specific HTTP client or connection. This makes the change process-wide and persistent for the lifetime of the Jenkins controller.

Attack Vector

The attack vector is Network. An attacker capable of intercepting proxied traffic between the Jenkins JVM and a remote HTTPS server can trigger a downgraded authentication handshake. The proxy receives Basic credentials in cleartext during the CONNECT negotiation, allowing credential theft. See the Jenkins Security Advisory SECURITY-3326 and the OpenWall OSS Security discussion for vendor detail.

Detection Methods for CVE-2025-64135

Indicators of Compromise

Jenkins plugin manager listing eggplant-runner at version 0.0.1.301.v963cffe8ddb_8 or earlier
JVM arguments or runtime state showing jdk.http.auth.tunneling.disabledSchemes set to an empty value
Unexpected Basic authentication headers observed on outbound proxy CONNECT requests originating from Jenkins hosts

Detection Strategies

Inventory installed Jenkins plugins and compare versions against the fixed release listed in SECURITY-3326
Inspect the running Jenkins JVM using tooling such as jcmd <pid> VM.system_properties and confirm the default value for jdk.http.auth.tunneling.disabledSchemes
Review outbound proxy logs for CONNECT requests originating from Jenkins controllers or agents that carry Proxy-Authorization: Basic headers

Monitoring Recommendations

Alert on Jenkins plugin installations or upgrades that reintroduce vulnerable versions
Correlate proxy authentication events with Jenkins build activity to identify credential exposure windows
Track network egress from CI/CD infrastructure to unexpected proxy endpoints

How to Mitigate CVE-2025-64135

Immediate Actions Required

Identify Jenkins controllers running the Eggplant Runner Plugin and confirm the installed version
Restrict outbound proxy paths used by Jenkins agents to trusted, TLS-terminated infrastructure
Rotate any credentials that may have been used by the plugin or by other code paths in the affected JVM

Patch Information

Refer to Jenkins Security Advisory SECURITY-3326 for the corrected plugin release. At the time of publication, no fixed version is announced in the advisory, and administrators should treat all installations of 0.0.1.301.v963cffe8ddb_8 and earlier as affected.

Workarounds

Uninstall or disable the Eggplant Runner Plugin until a patched release is available
Explicitly enforce -Djdk.http.auth.tunneling.disabledSchemes=Basic in the Jenkins JVM startup arguments to override the plugin's runtime change
Avoid routing Jenkins HTTPS traffic through HTTP proxies where feasible, or terminate TLS only at trusted endpoints

bash

# Configuration example: enforce the Java default in Jenkins startup
JAVA_OPTS="$JAVA_OPTS -Djdk.http.auth.tunneling.disabledSchemes=Basic"
export JAVA_OPTS