CVE-2025-58460: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability (CVE-2025-58460) was discovered in Jenkins OpenTelemetry Plugin versions 3.1543.v8446b92bcd64 and earlier. The vulnerability was disclosed on September 3, 2025, affecting the Jenkins OpenTelemetry Plugin. This security issue was reported by Kevin Guerroudj from CloudBees, Inc (Jenkins Advisory).

The vulnerability stems from a missing permission check in a method implementing form validation in the OpenTelemetry Plugin. The issue has been assigned a CVSS v3.1 base score of 4.2 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD, AttackerKB).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of credentials stored in Jenkins (Jenkins Advisory).

The vulnerability has been fixed in OpenTelemetry Plugin version 3.1543.1545.vf5a_4ec123769, which implements proper permission checks by requiring Overall/Administer permission for the affected form validation method. Users are advised to update to this version to mitigate the vulnerability (Jenkins Advisory).