CVE-2025-67636: Jenkins Core Missing Permission Check on Password Fields
Summary
CVE-2025-67636: Jenkins is missing a permission check on password fields. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.528.3
>= 2.529, < 2.541
Fixed in 2.528.3 or 2.541, depending on the release line you run. How to fix ↓
Also tracked for
- jenkins · Bitnami
The same CVE-2025-67636 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software. It is widely used for continuous integration and continuous delivery (CI/CD) processes. The core functionality of Jenkins includes managing and automating the software development lifecycle through plugins that enhance its capabilities. However, vulnerabilities in Jenkins can expose sensitive information, such as encrypted passwords, which can lead to unauthorized access and security breaches.
Vulnerability Detail
A missing permission check in Jenkins versions 2.540 and earlier, including LTS 2.528.2 and earlier, allows attackers with View/Read permission to access and view encrypted password values in views. This vulnerability arises from inadequate access controls, which can lead to potential exploitation by malicious users who can gain insights into sensitive credentials, thereby compromising the security of the Jenkins environment.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.528.32.528.3 -
>= 2.529, < 2.5412.541
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to Jenkins views and ensure that only trusted users have View/Read permissions. This can help mitigate the risk of unauthorized access to encrypted password values until the software is updated.
Conclusion
The missing permission check in Jenkins poses a significant risk by allowing unauthorized users to view sensitive encrypted password values. It is crucial for users to update their Jenkins installations to the latest patched versions to mitigate this vulnerability and protect their systems from potential exploitation.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
CVE-2025-67636 is a vulnerability in Jenkins that allows users with View/Read permission to view encrypted password values due to a missing permission check.
Jenkins versions 2.540 and earlier, as well as LTS versions 2.528.2 and earlier, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your application's pom.xml file on the Vulert playground, you can determine if it is affected by this vulnerability.
The CVSS score for this vulnerability is 4.3, indicating a moderate level of severity.
If immediate updates are not possible, restrict access to Jenkins views and limit View/Read permissions to trusted users as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
