CVE-2025-67638: Jenkins Core Build Authorization Token Exposed in Plain Text
Summary
CVE-2025-67638: Jenkins's build authorization token is stored and displayed in plain text. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.528.3
>= 2.529, < 2.541
Fixed in 2.528.3 or 2.541, depending on the release line you run. How to fix ↓
Also tracked for
- jenkins · Bitnami
The same CVE-2025-67638 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software. It is widely used for continuous integration and continuous delivery (CI/CD) processes. Jenkins allows users to configure jobs and manage builds through a web interface. However, certain versions of Jenkins have a vulnerability where build authorization tokens are displayed in plain text, posing a security risk.
Vulnerability Detail
The vulnerability arises from Jenkins versions 2.540 and earlier, including LTS 2.528.2 and earlier, which do not mask build authorization tokens on the job configuration form. This oversight allows unauthorized users to potentially observe and capture these tokens, leading to unauthorized access to build processes and sensitive data. The vulnerability is classified under CWE-312, which pertains to the exposure of sensitive information.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.528.32.528.3 -
>= 2.529, < 2.5412.541
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should restrict access to the Jenkins job configuration page to trusted personnel only. Additionally, consider using environment variables or secure credential storage to manage sensitive tokens instead of displaying them in the UI.
Conclusion
The vulnerability identified as CVE-2025-67638 in Jenkins poses a significant risk by exposing build authorization tokens in plain text. Users are strongly advised to update to the latest versions to mitigate this risk and ensure the security of their CI/CD processes.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Jenkins versions 2.540 and earlier, as well as LTS 2.528.2 and earlier, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Build authorization tokens are credentials used by Jenkins to authorize and authenticate build processes. If exposed, they can lead to unauthorized access.
If immediate updates are not possible, ensure that access to the Jenkins job configuration page is restricted and consider using secure methods for managing sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
