CVE-2025-53660: QMetry Test Management Plugin Vulnerability Exposes API Keys
Summary
CVE-2025-53660: Jenkins QMetry Test Management Plugin vulnerability exposes API keys. Affects org.jenkins-ci.plugins:qmetry-test-management versions < 1.13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The QMetry Test Management Plugin for Jenkins is designed to facilitate test management by integrating QMetry's automation capabilities into Jenkins. It allows users to manage test cases, execute tests, and track results directly within the Jenkins environment. However, this plugin has a critical security flaw that compromises sensitive API keys, which are essential for authenticating with QMetry's services.
Vulnerability Detail
The vulnerability in the QMetry Test Management Plugin stems from its practice of storing Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller. This means that any user with Item/Extended Read permission or access to the Jenkins file system can view these API keys. Furthermore, the job configuration form does not mask these keys, increasing the risk of exposure to potential attackers. The ramifications of this vulnerability include unauthorized access to QMetry services, data breaches, and potential exploitation of the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. However, it is advisable to restrict access to the Jenkins controller and limit permissions for users to mitigate the risk of exposure to the API keys.
Conclusion
The QMetry Test Management Plugin vulnerability (CVE-2025-53660) poses a significant risk by exposing API keys due to unencrypted storage. Users are urged to monitor for updates and restrict access to mitigate potential threats.
See every vulnerability recorded for org.jenkins-ci.plugins:qmetry-test-management →
FAQ
CVE-2025-53660 is a vulnerability in the QMetry Test Management Plugin for Jenkins that exposes sensitive API keys due to unencrypted storage.
The risks include unauthorized access to QMetry services, potential data breaches, and exploitation of the Jenkins environment.
As of now, there is no patch available. Users should monitor the plugin repository for updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If affected, restrict access to your Jenkins environment and monitor for any unauthorized access. Apply any patches as soon as they become available.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:qmetry-test-management.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
