CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - jenkinsci-cert@googlegroups.com

Published

2025-12-10

Last modified

2026-10-14

Weaknesses

CWE-282

Affected products

• Hashicorp Vault (Jenkins)
• Jenkins Hashicorp Vault Plugin (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3045