CVE-2025-53653: Jenkins Aqua Security Scanner Plugin Vulnerability Exposes Scanner Tokens
Summary
CVE-2025-53653: Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens. Affects org.jenkins-ci.plugins:aqua-security-scanner versions < 3.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Aqua Security Scanner Plugin is designed to integrate Aqua Security's scanning capabilities into Jenkins, allowing users to assess the security of their applications during the CI/CD process. This plugin facilitates the scanning of container images and provides insights into vulnerabilities, compliance, and best practices. However, a critical security issue has been identified in versions 3.2.8 and earlier, where sensitive tokens are stored unencrypted, posing a risk to users with certain permissions.
Vulnerability Detail
The vulnerability stems from the Jenkins Aqua Security Scanner Plugin storing Scanner Tokens for Aqua API in an unencrypted format within the job config.xml files on the Jenkins controller. This insecure storage method allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these tokens. The implications of this vulnerability are significant, as it could lead to unauthorized access to the Aqua API, potentially compromising the security of the applications being scanned.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, users should restrict access to the Jenkins controller file system and ensure that only trusted users have Item/Extended Read permissions. Additionally, consider using alternative methods for storing sensitive tokens, such as environment variables or secure credential storage solutions.
Conclusion
The Jenkins Aqua Security Scanner Plugin vulnerability (CVE-2025-53653) poses a significant risk by exposing sensitive scanner tokens. Users are advised to restrict access and monitor for updates while awaiting a fix. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:aqua-security-scanner →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The vulnerability affects Jenkins Aqua Security Scanner Plugin versions 3.2.8 and earlier.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
As of the publication of this advisory, there is no timeline for a fix. Users should stay updated by monitoring the plugin's official repository.
If you cannot update the plugin, ensure that access to the Jenkins controller is restricted and consider using secure methods for storing sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:aqua-security-scanner.
