CVE-2025-53668: Jenkins VAddy Plugin Exposes Unencrypted API Auth Keys
Summary
CVE-2025-53668: Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users. Affects org.jenkins-ci.plugins:vaddy-plugin versions < 1.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins VAddy Plugin is designed to integrate VAddy, a service that provides API access for various functionalities within Jenkins. This plugin allows users to manage and utilize VAddy features directly from their Jenkins environment. However, the plugin has a critical security flaw that affects how sensitive information, specifically API authentication keys, are stored.
Vulnerability Detail
The vulnerability in the Jenkins VAddy Plugin arises from the insecure storage of Vaddy API Auth Keys in the job config.xml files on the Jenkins controller. This means that any user with Item/Extended Read permission or access to the Jenkins controller file system can view these unencrypted keys. The implications of this vulnerability are significant, as it can lead to unauthorized access to the VAddy service, potentially compromising sensitive data and operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Jenkins controller file system and limit Item/Extended Read permissions to trusted users only. This will help mitigate the risk of unauthorized access to the sensitive information stored in the config.xml files.
Conclusion
The Jenkins VAddy Plugin has a vulnerability that exposes unencrypted API Auth Keys, which can be viewed by unauthorized users. It is crucial to update to the patched version to secure your Jenkins environment and protect sensitive information.
See every vulnerability recorded for org.jenkins-ci.plugins:vaddy-plugin →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failing to address this vulnerability can lead to unauthorized access to your VAddy API, potentially compromising sensitive data and operations within your Jenkins environment.
Yes, you can restrict access to the Jenkins controller file system and limit permissions for users to reduce the risk of exposure.
You can find more information about the Jenkins VAddy Plugin on its official Jenkins plugin page or GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vaddy-plugin.
