CVE-2025-31724: Jenkins Cadence vManager Plugin Unencrypted API Key Storage Vulnerability
Summary
CVE-2025-31724: Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted. Affects org.jenkins-ci.plugins:vmanager-plugin versions < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Cadence vManager Plugin is an integration tool designed to facilitate the management of Verisium Manager APIs within Jenkins. It allows users to configure and manage API interactions seamlessly as part of their CI/CD pipelines. However, earlier versions of this plugin have a critical security flaw that exposes sensitive API keys in plaintext, making them accessible to unauthorized users.
Vulnerability Detail
The Jenkins Cadence vManager Plugin versions 4.0.0-282.v5096a_c2db_275 and earlier store Verisium Manager vAPI keys unencrypted in the job config.xml files on the Jenkins controller. This vulnerability arises from improper handling of sensitive information, allowing users with Item/Extended Read permission or access to the Jenkins file system to view these API keys. The implications of this vulnerability are significant, as it can lead to unauthorized access to the Verisium Manager, potentially compromising sensitive data and operations.
How To Fix
Minimum fixed version
4.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Jenkins controller file system and ensure that only trusted users have Item/Extended Read permissions. This will help mitigate the risk of unauthorized access to the unencrypted API keys until the plugin is updated.
Conclusion
The Jenkins Cadence vManager Plugin has a vulnerability that exposes Verisium Manager vAPI keys in an unencrypted format, posing a security risk. Users are advised to update to the patched version to secure their API keys and prevent unauthorized access. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for org.jenkins-ci.plugins:vmanager-plugin →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Unencrypted API keys can be easily accessed by unauthorized users, leading to potential data breaches, unauthorized access to services, and exploitation of the affected system.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities in your software using just the pom.xml file.
If immediate updates are not possible, ensure to limit access to the Jenkins system and monitor for any suspicious activity until the plugin can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vmanager-plugin.
