CVE-2025-53742: Jenkins Applitools Eyes Plugin Exposes Unencrypted API Keys
Summary
CVE-2025-53742: Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users. Affects org.jenkins-ci.plugins:pplitools-eyes versions < 1.16.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Applitools Eyes Plugin is an integration tool that allows Jenkins users to utilize Applitools' visual testing capabilities within their CI/CD pipelines. This plugin enables automated visual testing, helping developers ensure that their applications appear as intended across different browsers and devices. However, it has a critical vulnerability that affects the security of sensitive information stored within Jenkins job configurations.
Vulnerability Detail
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier store Applitools API keys in an unencrypted format within the job config.xml files on the Jenkins controller. This exposes sensitive API keys to users who have Item/Extended Read permission or direct access to the Jenkins controller file system. The vulnerability arises from inadequate encryption practices, allowing unauthorized access to sensitive credentials, which could lead to unauthorized use of the Applitools service and potential data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Jenkins controller file system and limit Item/Extended Read permissions to trusted users only. This will help mitigate the risk of unauthorized access to the unencrypted API keys until the plugin is updated.
Conclusion
The Jenkins Applitools Eyes Plugin vulnerability (CVE-2025-53742) poses a significant risk by exposing unencrypted API keys. Users are strongly advised to update to the latest version of the plugin to secure their sensitive information. Implementing access restrictions can serve as a temporary measure until the update is applied.
See every vulnerability recorded for org.jenkins-ci.plugins:pplitools-eyes →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
Any Jenkins user utilizing the Applitools Eyes Plugin version 1.16.5 or earlier is at risk.
If exploited, unauthorized users could gain access to sensitive Applitools API keys, leading to unauthorized use of the service and potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, restrict access to the Jenkins controller file system and limit permissions for users to reduce the risk of exposure.
