CVE-2025-64149: Jenkins Publish to Bitbucket Plugin CSRF and Permission Check Vulnerability
Summary
CVE-2025-64149: Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check. Affects org.jenkins-ci.plugins:publish-to-bitbucket versions < 0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Publish to Bitbucket Plugin is a tool that facilitates the integration of Jenkins with Bitbucket, allowing users to publish build results and manage repositories directly from Jenkins. This plugin is widely used in continuous integration and deployment workflows. However, versions 0.4 and earlier are vulnerable to a critical security issue that compromises user credentials and exposes the system to cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from the lack of a proper permission check in an HTTP endpoint of the Jenkins Publish to Bitbucket Plugin. Attackers with Overall/Read permission can exploit this flaw to connect to an attacker-specified HTTP URL using credentials IDs that they obtain through other means. This not only allows unauthorized access to sensitive credentials stored in Jenkins but also opens the door for CSRF attacks, as the endpoint does not enforce POST requests. The ramifications include potential credential theft and unauthorized actions being performed on behalf of legitimate users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk associated with this vulnerability, it is recommended to restrict access to the Jenkins instance and limit the Overall/Read permissions to trusted users only. Additionally, consider implementing CSRF protection mechanisms at the application level.
Conclusion
The Jenkins Publish to Bitbucket Plugin is currently vulnerable to a significant security issue that can lead to credential theft and CSRF attacks. Users are urged to monitor for updates and apply necessary precautions to protect their Jenkins instances.
See every vulnerability recorded for org.jenkins-ci.plugins:publish-to-bitbucket →
FAQ
CVE-2025-64149 is a vulnerability in the Jenkins Publish to Bitbucket Plugin that allows unauthorized access to user credentials and exposes the system to CSRF attacks.
The vulnerability affects Jenkins Publish to Bitbucket Plugin version 0.4 and earlier.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
As of now, there is no patch available for this vulnerability. Users should monitor the plugin repository for updates.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:publish-to-bitbucket.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
