CVE-2025-67637: 
Java vulnerability analysis and mitigation

CVE-2025-67637 is a cleartext storage vulnerability in Jenkins core (tracked as SECURITY-783) where build authorization tokens are stored unencrypted in job config.xml files on the Jenkins controller. It affects Jenkins weekly versions up to and including 2.540 and LTS versions up to and including 2.528.2. The vulnerability was disclosed on December 10, 2025, as part of the Jenkins Security Advisory 2025-12-10. It carries a CVSS v3.1 base score of 4.3 (Medium) (Jenkins Advisory, GitHub Advisory).

The root cause is classified as CWE-312 (Cleartext Storage of Sensitive Information): Jenkins stores build authorization tokens in plaintext within job config.xml files rather than encrypting them at rest. Any user with Item/Extended Read permission — a relatively low-privilege role — can read these files via the Jenkins UI or API, and users with direct filesystem access to the Jenkins controller can read them directly from disk. A companion issue, CVE-2025-67638, covers the related masking failure where the job configuration form also displays these tokens in plaintext, further increasing exposure risk. The vulnerability was reported by James Nord of CloudBees, Inc. (Jenkins Advisory).

Successful exploitation allows a low-privileged authenticated attacker to retrieve build authorization tokens, which are used to trigger Jenkins builds remotely without further authentication. An attacker who obtains these tokens could trigger unauthorized builds, potentially injecting malicious code into CI/CD pipelines and compromising build integrity and supply chain security. The impact is limited to confidentiality (low), with no direct integrity or availability impact from this specific CVE, though the stolen tokens could enable further attacks on the CI/CD environment (Jenkins Advisory, GitHub Advisory).

1. Reconnaissance: Identify a Jenkins instance running weekly version 2.540 or earlier, or LTS 2.528.2 or earlier, using version disclosure from the Jenkins UI or HTTP response headers.
2. Obtain low-privilege access: Authenticate to Jenkins with an account that has at minimum Item/Extended Read permission on one or more jobs.
3. Access job configuration: Navigate to the target job's configuration page or use the Jenkins REST API (e.g., GET /job/<job-name>/config.xml) to retrieve the raw job config.xml file.
4. Extract the token: Locate the <authToken> element in the XML response, which contains the build authorization token in plaintext.
5. Abuse the token: Use the extracted token to trigger unauthorized remote builds via the Jenkins remote build trigger URL (e.g., https://<jenkins>/job/<job-name>/build?token=<extracted-token>), potentially injecting malicious steps or exfiltrating build artifacts (Jenkins Advisory, GitHub Advisory).

• Network: Unexpected HTTP GET requests to /job/<job-name>/config.xml from low-privilege user accounts; unusual remote build trigger requests to /job/<job-name>/build?token=<token> from unfamiliar IP addresses.
• Logs: Jenkins access logs showing repeated config.xml retrieval by accounts that do not normally access job configurations; build trigger events initiated via token authentication from unexpected sources.
• File System: Direct access to $JENKINS_HOME/jobs/<job-name>/config.xml files outside of normal administrative activity; presence of scripts or tools on the controller filesystem that enumerate job configuration files.

Upgrade Jenkins weekly to version 2.541 or Jenkins LTS to version 2.528.3, which masks build authorization tokens in the configuration form and stores them encrypted after job configurations are re-saved. To migrate all existing affected job configurations to the encrypted format at once, navigate to Manage Jenkins → Manage Old Data and select Upgrade under the "Old Data Format" section. As an interim measure, restrict Item/Extended Read permissions to only trusted users and audit who has access to the Jenkins controller filesystem (Jenkins Advisory).

The vulnerability was reported by James Nord of CloudBees, Inc. and disclosed as part of the broader Jenkins Security Advisory on December 10, 2025, which also covered several other medium-to-high severity issues. Security news outlets such as SecurityOnline.info covered the advisory, highlighting the higher-severity DoS and XSS issues alongside this token storage flaw. No significant independent researcher commentary or notable social media discussion specific to CVE-2025-67637 has been identified (Jenkins Advisory).