CVE-2025-67642: Jenkins HashiCorp Vault Plugin Exposes System-Scoped Vault Credentials
Summary
CVE-2025-67642: Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials. Affects com.datapipe.jenkins.plugins:hashicorp-vault-plugin versions < 371. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins HashiCorp Vault Plugin is an integration tool that allows Jenkins users to securely access and manage secrets stored in HashiCorp Vault. This plugin is essential for CI/CD pipelines that require sensitive information, such as API keys and passwords, to be handled securely. However, the plugin has a vulnerability that affects its ability to restrict access to Vault credentials, potentially exposing sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability in the Jenkins HashiCorp Vault Plugin arises from improper context handling during Vault credentials lookup. Specifically, versions 371.v884a_4dd60fb_6 and earlier do not enforce adequate access controls, allowing users with Item/Configure permissions to access Vault credentials they should not have access to. This could lead to unauthorized access to sensitive information, posing a significant security risk to organizations relying on this plugin for secret management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, organizations can restrict Item/Configure permissions for users who should not have access to Vault credentials until the plugin is updated. This can be done by reviewing user roles and permissions within Jenkins and ensuring that only authorized personnel have the necessary access.
Conclusion
The Jenkins HashiCorp Vault Plugin vulnerability (CVE-2025-67642) poses a significant risk by allowing unauthorized access to sensitive Vault credentials. It is crucial for users to update to the latest version of the plugin and review their permission settings to mitigate this risk effectively.
See every vulnerability recorded for com.datapipe.jenkins.plugins:hashicorp-vault-plugin →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions 371.v884a_4dd60fb_6 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive Vault credentials, which could lead to data breaches and compromise of secure systems.
Yes, a patched version of the Jenkins HashiCorp Vault Plugin is available. Users should update to a version later than 371.v884a_4dd60fb_6.
Related vulnerabilities
Recent vulnerabilities recorded for com.datapipe.jenkins.plugins:hashicorp-vault-plugin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
