CVE-2025-53663: Jenkins IBM Cloud DevOps Plugin Vulnerability Exposes SonarQube Authentication Tokens
Summary
CVE-2025-53663: Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens. Affects com.ibm.devops:ibm-cloud-devops versions < 2.0.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins IBM Cloud DevOps Plugin is a tool that integrates IBM Cloud DevOps services with Jenkins, enabling users to manage their DevOps processes effectively. This plugin allows for seamless interaction with SonarQube, a popular tool for continuous inspection of code quality. However, the plugin has a critical vulnerability that affects how it handles sensitive authentication tokens.
Vulnerability Detail
The vulnerability arises from the plugin's practice of storing SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller. This means that any user with Item/Extended Read permission or access to the Jenkins controller file system can view these tokens. The implications of this vulnerability are significant, as it exposes sensitive credentials that could be exploited for unauthorized access to SonarQube and potentially compromise the integrity of the development environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users should limit access to the Jenkins controller file system and ensure that only trusted users have Item/Extended Read permissions to mitigate the risk of token exposure.
Conclusion
The Jenkins IBM Cloud DevOps Plugin vulnerability (CVE-2025-53663) poses a significant risk by exposing SonarQube authentication tokens in an unencrypted format. Users should remain vigilant and monitor for updates, while also considering the use of tools like Vulert to assess their applications for vulnerabilities.
See every vulnerability recorded for com.ibm.devops:ibm-cloud-devops →
FAQ
CVE-2025-53663 is a vulnerability in the Jenkins IBM Cloud DevOps Plugin that exposes SonarQube authentication tokens in an unencrypted format.
Any user of the Jenkins IBM Cloud DevOps Plugin version 2.0.16 and earlier is potentially affected by this vulnerability.
The main risk is that unauthorized users can access sensitive SonarQube authentication tokens, leading to potential unauthorized access to the SonarQube service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your pom.xml file to the Vulert playground, you can check for vulnerabilities without requiring any installation or signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
