CVE-2025-64141: Jenkins Nexus Task Runner Plugin Cross-Site Request Forgery Vulnerability
Summary
CVE-2025-64141: Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery. Affects org.jenkins-ci.plugins:nexus-task-runner versions < 0.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Nexus Task Runner Plugin is a tool that integrates Jenkins with Nexus Repository Manager, allowing users to automate tasks related to artifact management. This plugin is designed to facilitate the deployment and retrieval of artifacts in a continuous integration/continuous deployment (CI/CD) pipeline. However, versions 0.9.2 and earlier are vulnerable to a cross-site request forgery (CSRF) attack due to insufficient permission checks in its HTTP endpoints.
Vulnerability Detail
The vulnerability arises from the lack of permission checks in an HTTP endpoint of the Jenkins Nexus Task Runner Plugin. Attackers with Overall/Read permission can exploit this flaw to connect to a URL of their choosing using arbitrary credentials. Additionally, the endpoint does not enforce POST requests, making it susceptible to CSRF attacks. This could allow unauthorized actions to be performed on behalf of a user without their consent, potentially leading to data exposure or manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users should limit access to the Jenkins instance and ensure that only trusted users have Overall/Read permissions to minimize the risk of exploitation.
Conclusion
The Jenkins Nexus Task Runner Plugin is currently vulnerable to a CSRF attack due to insufficient permission checks in its HTTP endpoints. Users are advised to monitor for updates and limit access to their Jenkins instances to mitigate risks until a fix is available.
See every vulnerability recorded for org.jenkins-ci.plugins:nexus-task-runner →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions 0.9.2 and earlier of the Jenkins Nexus Task Runner Plugin are affected by this vulnerability.
This vulnerability allows attackers to perform cross-site request forgery (CSRF) attacks, potentially leading to unauthorized actions on behalf of a user.
As of now, there is no patch available for this vulnerability. Users should monitor the plugin's repository for updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:nexus-task-runner.
