A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 10, 2025 · NIST NVD

   Detected

   A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

2. Oct 14, 2026 · NIST NVD

   Updated

   A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Affected

• cpe jenkins/jenkinsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67639

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67639

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-67639

  A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

  nvd.nist.gov

References

• Vendor Advisory · jenkins.io