ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67637

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be vi…

Published Dec 10, 2025 · updated Oct 14, 2026 · jenkins jenkins

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2025 · NIST NVD

    Detected

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected

  • cpe jenkins/jenkinsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-67637

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-67637

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2025-67637

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

    nvd.nist.gov

References