ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67638

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attac…

Published Dec 10, 2025 · updated Oct 14, 2026 · jenkins jenkins

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2025 · NIST NVD

    Detected

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Affected

  • cpe jenkins/jenkinsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-67638

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-67638

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2025-67638

    Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

    nvd.nist.gov

References