CVE-2025-64143: Medium severity Jenkins OpenShift Pipeline Plugin vulnerability
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
Other sources
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64143?
CVE-2025-64143 has a high severity rating due to the exposure of sensitive authorization tokens.
How do I fix CVE-2025-64143?
To fix CVE-2025-64143, upgrade to version 1.0.58 or later of the Jenkins OpenShift Pipeline Plugin.
What are the risks associated with CVE-2025-64143?
The risk associated with CVE-2025-64143 includes unauthorized access to sensitive information by users with read permissions.
Which versions are affected by CVE-2025-64143?
CVE-2025-64143 affects Jenkins OpenShift Pipeline Plugin version 1.0.57 and earlier.
How can users mitigate the impact of CVE-2025-64143?
Users can mitigate the impact of CVE-2025-64143 by restricting access to the Jenkins controller and applying the recommended update.