GHSA-p3f5-98cv-562j

Jenkins is missing a permission check on password fields

At a glance

Published: 2025-12-10 18:30 UTC
Updated: 2026-09-10 03:50 UTC
CVE: CVE-2025-67636
Aliases: BIT-jenkins-2025-67636
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 2.529, fixed 2.541
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 2.528.3

References

https://nvd.nist.gov/vuln/detail/CVE-2025-67636 ADVISORY
https://github.com/jenkinsci/jenkins/commit/3ee7380c5e167fab865f58b52a81ef01c24b9eb2 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database