CVE-2025-64147: Jenkins Curseforge Publisher Plugin API Key Exposure Vulnerability
Summary
CVE-2025-64147: Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form. Affects org.jenkins-ci.plugins:curseforge-publisher versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Curseforge Publisher Plugin is designed to facilitate the publishing of mods to Curseforge directly from Jenkins. It allows developers to automate the deployment process, enhancing productivity and efficiency. However, versions 1.0 and earlier of this plugin have a significant security flaw that exposes sensitive API keys in plaintext, making them accessible to unauthorized users.
Vulnerability Detail
The Jenkins Curseforge Publisher Plugin stores API keys unencrypted in the job configuration files (config.xml) on the Jenkins controller. This vulnerability arises from inadequate security measures, allowing users with Item/Extended Read permissions or access to the Jenkins file system to view these keys. The lack of masking in the job configuration form further exacerbates the risk, as it increases the likelihood of these keys being captured by malicious actors. The potential ramifications include unauthorized access to the Curseforge API, leading to data breaches or malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are encouraged to limit access to the Jenkins controller and ensure that only trusted personnel have Item/Extended Read permissions.
Conclusion
The Jenkins Curseforge Publisher Plugin has a critical vulnerability that exposes API keys in plaintext, posing a risk to users' security. While no fix is currently available, users should take precautions to limit access and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:curseforge-publisher →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions 1.0 and earlier of the Jenkins Curseforge Publisher Plugin are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have exposed API keys, it is recommended to revoke them immediately and generate new keys to prevent unauthorized access.
While there is no fix currently available, you can limit access to the Jenkins controller and ensure that only trusted users have permissions to view job configurations.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:curseforge-publisher.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
