CVE-2025-53662: Jenkins IFTTT Build Notifier Plugin Exposes IFTTT Maker Channel Keys
Summary
CVE-2025-53662: Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys. Affects org.jenkins-ci.plugins:ifttt-build-notifier versions < 1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins IFTTT Build Notifier Plugin is a tool that integrates Jenkins with IFTTT (If This Then That), allowing users to trigger actions in IFTTT based on Jenkins build events. This plugin is widely used in CI/CD pipelines to automate notifications and actions. However, it has a critical vulnerability that affects its security by storing sensitive information unencrypted.
Vulnerability Detail
Jenkins IFTTT Build Notifier Plugin versions 1.2 and earlier store IFTTT Maker Channel Keys in plain text within job 'config.xml' files on the Jenkins controller. This vulnerability arises from inadequate encryption practices, allowing users with Item/Extended Read permission or access to the Jenkins file system to view these sensitive keys. The ramifications include unauthorized access to IFTTT services, potentially leading to further exploitation of connected services.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk, users should restrict access to the Jenkins controller file system and limit permissions for users who can view job configurations. Additionally, consider removing sensitive keys from the configuration and storing them securely outside of Jenkins.
Conclusion
The Jenkins IFTTT Build Notifier Plugin vulnerability (CVE-2025-53662) poses a significant risk by exposing sensitive IFTTT Maker Channel Keys. Users should take immediate steps to secure their Jenkins instances and monitor for updates regarding a patch.
See every vulnerability recorded for org.jenkins-ci.plugins:ifttt-build-notifier →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
Any Jenkins instance using the IFTTT Build Notifier Plugin version 1.2 or earlier is at risk.
Exposed IFTTT Maker Channel Keys can lead to unauthorized access to IFTTT services, allowing malicious actions to be triggered.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
Yes, restrict access to the Jenkins file system and limit user permissions to mitigate the risk of exposure.
