CVE-2025-67638: Jenkins Information Disclosure Vulnerability

CVE-2025-67638 Overview

Jenkins versions 2.540 and earlier, along with LTS 2.528.2 and earlier, fail to mask build authorization tokens shown on the job configuration form. Users with configuration access to a job can observe the plaintext token value directly in the browser interface. Attackers who capture these tokens can trigger builds without further authentication, bypassing intended access controls.

The issue is tracked under CWE-312: Cleartext Storage of Sensitive Information and was disclosed in the Jenkins Security Advisory 2025-12-10 as SECURITY-783.

Critical Impact
Authenticated users with job configuration access can view build authorization tokens in cleartext, enabling unauthorized build triggering and lateral movement within CI/CD pipelines.

Affected Products

Jenkins weekly releases 2.540 and earlier
Jenkins LTS 2.528.2 and earlier
Jenkins jobs configured with build authorization tokens

Discovery Timeline

2025-12-10 - Jenkins publishes Security Advisory 2025-12-10 (SECURITY-783)
2025-12-10 - CVE-2025-67638 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67638

Vulnerability Analysis

Jenkins allows administrators to assign build authorization tokens to jobs. These tokens permit remote build triggering through URL parameters without requiring full user authentication. The tokens function as shared secrets and must remain confidential.

Affected Jenkins versions render the token value as plaintext within the job configuration form. Any user with Job/Configure permission can read the token by opening the job configuration page. Browser screenshots, shoulder-surfing, screen-sharing sessions, and page caches all become disclosure channels.

The flaw does not require exploitation of a parser or memory bug. It is a design-level information exposure in the user interface layer.

Root Cause

The root cause is a missing input masking attribute on the token field in the job configuration form template. Password-style fields in Jenkins typically use the <f:password> form control, which renders values as masked input. The build authorization token field instead rendered as a plaintext control, exposing the stored secret to any authorized viewer.

Attack Vector

An attacker who obtains Job/Configure permission through legitimate access, a compromised account, or a session hijack can navigate to the affected job and copy the token from the form field. Once captured, the attacker submits an HTTP request to the Jenkins build trigger endpoint with the token as a query parameter, launching builds under the associated job context.

The attack requires low privileges and network access to the Jenkins interface. It does not require user interaction beyond viewing the configuration page. See the Jenkins Security Advisory for full technical detail.

Detection Methods for CVE-2025-67638

Indicators of Compromise

Unexpected build activity in Jenkins job history without an authenticated originating user
Access log entries showing buildWithParameters or build endpoint calls with token= query parameters from unfamiliar source IPs
HTTP GET requests to /job/<name>/configure from accounts that do not routinely edit job configuration
Sudden increase in remote build triggers immediately following a configuration page view

Detection Strategies

Correlate Jenkins access logs to identify users viewing job configuration pages followed by anonymous or scripted build triggers reusing the same token value
Alert on build triggers originating from IP addresses that have never authenticated interactively to Jenkins
Inventory all jobs using legacy build authorization tokens and flag configuration reads against them for review

Monitoring Recommendations

Forward Jenkins access.log and audit plugin output to a centralized logging system for query and correlation
Track Job/Configure permission grants and monitor which accounts hold this permission over time
Baseline normal build trigger patterns per job and alert on deviations in frequency or source

How to Mitigate CVE-2025-67638

Immediate Actions Required

Upgrade Jenkins weekly to version 2.541 or later, or Jenkins LTS to 2.528.3 or later
Rotate all existing build authorization tokens on jobs that were configured before the upgrade
Audit Job/Configure permission assignments and remove access from accounts that do not require it
Review Jenkins access logs for prior views of affected configuration pages by non-administrative users

Patch Information

Jenkins addressed the issue in the versions released alongside the Jenkins Security Advisory 2025-12-10. The fix masks the build authorization token field in the job configuration form so the stored value is no longer rendered in cleartext. Administrators should apply the patch and rotate tokens, because patching alone does not invalidate previously disclosed values.

Workarounds

Disable the legacy build authorization token feature and migrate remote build triggering to API tokens scoped to service accounts
Restrict Job/Configure permission to a small set of trusted administrators using role-based access control
Place Jenkins behind a reverse proxy that logs and rate-limits calls to build trigger endpoints

bash

# Verify current Jenkins version and identify jobs using build tokens
curl -s -u admin:APITOKEN https://jenkins.example.com/api/json | jq '.version'

# List job configuration files that contain an authToken element
find $JENKINS_HOME/jobs -name config.xml -exec grep -l '<authToken>' {} \;

# After upgrade, rotate tokens by removing the authToken element and reissuing via the UI