CVE-2025-67637: Jenkins Information Disclosure Vulnerability

CVE-2025-67637 Overview

CVE-2025-67637 is an information disclosure vulnerability in Jenkins, the widely deployed open-source automation server. Jenkins versions 2.540 and earlier, and LTS 2.528.2 and earlier, store build authorization tokens unencrypted in job config.xml files on the Jenkins controller. Users with Item/Extended Read permission or direct access to the Jenkins controller file system can view these tokens in cleartext. The flaw is tracked under CWE-312: Cleartext Storage of Sensitive Information and documented in the Jenkins Security Advisory 2025-12-10 as SECURITY-783.

Critical Impact
Authenticated users with read-level access can harvest build authorization tokens from job configuration files and reuse them to trigger builds they would not otherwise be authorized to run.

Affected Products

Jenkins weekly releases 2.540 and earlier
Jenkins LTS 2.528.2 and earlier
Job config.xml files stored on the Jenkins controller file system

Discovery Timeline

2025-12-10 - Jenkins project publishes Security Advisory 2025-12-10 (SECURITY-783)
2025-12-10 - CVE-2025-67637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67637

Vulnerability Analysis

Jenkins uses per-job build authorization tokens to let external callers trigger builds through the remote build API. These tokens act as shared secrets that bypass normal interactive authentication for the triggering request. In affected Jenkins versions, the token value is written to the job's config.xml file in plaintext rather than being encrypted with the Jenkins controller's secret key.

Any principal granted Item/Extended Read can retrieve the raw XML of a job through the web UI or REST API and read the token directly. Operators or attackers with file system access to $JENKINS_HOME/jobs/<job>/config.xml can read the same value without authenticating to Jenkins at all. Because the token is a bearer secret, an attacker who extracts it can trigger builds for that job from any network location that can reach the Jenkins controller.

Root Cause

The root cause is cleartext storage of a sensitive credential [CWE-312]. Jenkins exposes a Secret type intended to encrypt such values at rest using the controller's master.key derived cipher. Build authorization tokens were not migrated to this encrypted representation, so serialization writes the plaintext value into config.xml.

Attack Vector

Exploitation requires low-privileged authenticated access to Jenkins or filesystem access to the controller. An authenticated attacker with Item/Extended Read requests the raw job configuration, parses the <authToken> element, and then issues an HTTP request to /job/<name>/build?token=<value> to trigger a build. No user interaction is required. The vulnerability does not permit code execution or data modification directly through this flaw. See the Jenkins Security Advisory for complete technical details.

Detection Methods for CVE-2025-67637

Indicators of Compromise

Unexpected GET requests to /job/<name>/config.xml from accounts with only read-level permissions
Build triggers originating from unusual IP addresses using the token query parameter
Access to $JENKINS_HOME/jobs/*/config.xml files by non-administrative OS accounts
Build history entries attributed to anonymous or remote callers for jobs that are normally triggered via SCM polling or webhooks

Detection Strategies

Audit Jenkins access logs for requests to config.xml endpoints and correlate against the requesting user's assigned permissions
Scan existing config.xml files on controllers for populated <authToken> elements and flag jobs still using legacy build tokens
Monitor remote build API usage and alert on token-based triggers that fall outside expected automation windows

Monitoring Recommendations

Forward Jenkins controller access logs and file integrity events to a centralized log platform for correlation
Baseline normal build-trigger sources per job and alert on deviations such as new source IPs or user agents
Review Role-Based Access Control (RBAC) assignments quarterly to ensure Item/Extended Read is granted only where required

How to Mitigate CVE-2025-67637

Immediate Actions Required

Upgrade Jenkins weekly to version 2.541 or later, or Jenkins LTS to 2.528.3 or later as published in Security Advisory 2025-12-10
Rotate all existing build authorization tokens after upgrading, since previously stored values must be considered compromised
Review and reduce Item/Extended Read grants to the minimum set of users and service accounts
Restrict file system access to $JENKINS_HOME to the Jenkins service account and authorized administrators

Patch Information

The Jenkins project addressed CVE-2025-67637 in the releases referenced by the Jenkins Security Advisory 2025-12-10. After upgrading, build authorization tokens are stored using the encrypted Secret representation rather than as plaintext in config.xml.

Workarounds

Migrate jobs away from the legacy build authorization token to authenticated API token triggers tied to a dedicated service account
Place Jenkins behind a reverse proxy that enforces authentication on /job/*/build endpoints and strips the token query parameter from untrusted sources
Disable anonymous and overly permissive read permissions in the Jenkins global security configuration until the controller is patched

bash

# Identify jobs that still contain plaintext build authorization tokens
find "$JENKINS_HOME/jobs" -name config.xml \
  -exec grep -l '<authToken>' {} \;