CVE-2022-25186: 
Java vulnerability analysis and mitigation

Jenkins HashiCorp Vault Plugin version 3.8.0 and earlier contains a security vulnerability (CVE-2022-25186) that was disclosed on February 15, 2022. This vulnerability affects the plugin's functionality that allows agent processes to retrieve Vault secrets for use on the agent (Jenkins Advisory).

The vulnerability has been classified with a Low severity CVSS score. The issue stems from the implementation of functionality that allows agent processes to retrieve any Vault secrets for use on the agent. This implementation creates a security bypass that could be exploited by attackers who have control over agent processes (Jenkins Advisory).

The vulnerability allows attackers who have control over agent processes to obtain Vault secrets for any attacker-specified path and key. This means that compromised agent processes could potentially access sensitive information stored in HashiCorp Vault that they shouldn't normally have access to (Jenkins Advisory).

The vulnerability has been fixed in HashiCorp Vault Plugin version 336.v182c0fbaaeb7. In this version, the functionality that allowed agent processes to capture Vault secrets can no longer be used. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).