CVE-2025-53661: Jenkins Testsigma Test Plan Plugin API Key Exposure Vulnerability
Summary
CVE-2025-53661: Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form. Affects io.jenkins.plugins:testsigma versions < 1.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Testsigma Test Plan run Plugin is designed to facilitate the integration of Testsigma with Jenkins, allowing users to run Testsigma test plans directly from their Jenkins environment. This plugin enhances the CI/CD pipeline by enabling automated testing and reporting. However, it has been found to store sensitive API keys in job configuration files, which poses a security risk.
Vulnerability Detail
The vulnerability arises from the way the Testsigma Test Plan run Plugin handles API keys. In versions 1.6 and earlier, these keys are stored in the job 'config.xml' files on the Jenkins controller. Although the keys are encrypted on disk, they are not masked in the job configuration form, making them visible to users with access to the Jenkins interface. This exposure increases the risk of unauthorized access and potential exploitation by attackers who can observe and capture these keys.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to limit access to the Jenkins interface and ensure that only trusted users have permission to view job configurations.
Conclusion
The Jenkins Testsigma Test Plan run Plugin has a vulnerability that exposes API keys in job configuration files, posing a security risk. Users are advised to monitor for updates and restrict access to mitigate potential threats. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for io.jenkins.plugins:testsigma →
FAQ
CVE-2025-53661 is a vulnerability in the Jenkins Testsigma Test Plan run Plugin that exposes API keys in job configuration files.
The main risk is that unauthorized users could access sensitive API keys, potentially leading to unauthorized access to Testsigma services.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
As of now, there is no patch available for this vulnerability. Users should keep an eye on the plugin repository for future updates.
If you cannot update the plugin, consider restricting access to the Jenkins interface and monitoring for any suspicious activity.
