A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 10, 2025 · NIST NVD

   Detected

   A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

2. Oct 14, 2026 · NIST NVD

   Updated

   A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

Affected

• cpe jenkins/jenkinsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67636

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67636

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-67636

  A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

  nvd.nist.gov

References

• Vendor Advisory · jenkins.io