CVE-2025-53657: Jenkins ReadyAPI Functional Testing Plugin Exposes Sensitive Credentials
Summary
CVE-2025-53657: Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets. Affects org.jenkins-ci.plugins:soapui-pro-functional-testing versions < 1.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins ReadyAPI Functional Testing Plugin is designed to facilitate automated testing of APIs using the ReadyAPI tool. It allows users to integrate functional testing into their Jenkins CI/CD pipelines. However, this plugin has a critical vulnerability that compromises sensitive information, specifically SLM License Access Keys, client secrets, and passwords, which are stored unencrypted in job configuration files.
Vulnerability Detail
The vulnerability arises from the plugin's practice of storing sensitive credentials in plain text within the job config.xml files on the Jenkins controller. This insecure storage method allows users with Item/Extended Read permission or direct access to the Jenkins file system to view these credentials. Furthermore, the job configuration form does not mask these credentials, increasing the risk of exposure to potential attackers. The severity of this vulnerability is classified as moderate, with a CVSS score of 4.3, indicating a significant risk to users' sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should limit access to the Jenkins controller file system and restrict permissions for users who have Item/Extended Read access to job configurations. Additionally, consider using environment variables or secure credential storage solutions to manage sensitive information instead of relying on the plugin's configuration.
Conclusion
The Jenkins ReadyAPI Functional Testing Plugin vulnerability (CVE-2025-53657) poses a significant risk by exposing sensitive credentials. Users should take immediate action to limit access and monitor for updates regarding a fix. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:soapui-pro-functional-testing →
FAQ
CVE-2025-53657 is a vulnerability in the Jenkins ReadyAPI Functional Testing Plugin that exposes sensitive credentials stored in job configuration files.
If your Jenkins instance uses the affected plugin, sensitive credentials may be accessible to unauthorized users, leading to potential data breaches.
Currently, there is no patch available. Users should monitor the plugin's repository for updates.
Limit access to sensitive job configurations and consider using secure methods for storing credentials until a fix is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:soapui-pro-functional-testing.
