CVE-2025-64140: Jenkins Azure CLI Plugin Arbitrary Command Execution Vulnerability
Summary
CVE-2025-64140: Jenkins Azure CLI Plugin does not restrict the commands it executes. Affects org.jenkins-ci.plugins:azure-cli versions < 0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Azure CLI Plugin is an extension for Jenkins that allows users to execute Azure CLI commands directly from their Jenkins jobs. This plugin is widely used in CI/CD pipelines to automate cloud operations. However, versions 0.9 and earlier of this plugin have a critical security flaw that permits unauthorized command execution on the Jenkins controller, posing significant risks to system integrity and security.
Vulnerability Detail
The Jenkins Azure CLI Plugin versions 0.9 and earlier do not impose restrictions on the commands that can be executed on the Jenkins controller. This vulnerability arises from inadequate input validation, allowing attackers with Item/Configure permissions to execute arbitrary shell commands. The ramifications of this flaw are severe, as it can lead to unauthorized access, data breaches, and potential system compromise. The vulnerability is classified under CWE-78, which pertains to OS Command Injection.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to restrict access to Jenkins and limit permissions for users to prevent exploitation until a fix is available.
Conclusion
The Jenkins Azure CLI Plugin has a critical vulnerability that allows arbitrary command execution on the Jenkins controller. Users are advised to monitor for updates and restrict access to mitigate risks until a fix is available. The high CVSS score of 8.8 underscores the importance of addressing this issue promptly.
See every vulnerability recorded for org.jenkins-ci.plugins:azure-cli →
FAQ
The Jenkins Azure CLI Plugin allows Jenkins users to run Azure CLI commands within their CI/CD pipelines, facilitating automation of cloud operations.
The vulnerability affects Jenkins Azure CLI Plugin versions 0.9 and earlier.
An attacker needs Item/Configure permissions to exploit this vulnerability and execute arbitrary commands on the Jenkins controller.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
