ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configur…

Published Dec 10, 2025 · updated Oct 14, 2026 · jenkins hashicorp vault

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2025 · NIST NVD

    Detected

    Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Affected

  • cpe jenkins/hashicorp vaultversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-67642

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-67642

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2025-67642

    Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

    nvd.nist.gov

References