CVE-2025-64146: Medium severity Jenkins Curseforge Publisher Plugin vulnerability
Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these keys, increasing the potential for attackers to observe and capture them.
As of publication of this advisory, there is no fix.
Other sources
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64146?
CVE-2025-64146 has been classified as a high-severity vulnerability due to the exposure of sensitive API keys.
How do I fix CVE-2025-64146?
To fix CVE-2025-64146, you should upgrade the Jenkins Curseforge Publisher Plugin to a version that encrypts API keys.
What data is exposed in CVE-2025-64146?
CVE-2025-64146 exposes unencrypted API keys stored in job config.xml files on the Jenkins controller.
Who is affected by CVE-2025-64146?
Users with Item/Extended Read permission or access to the Jenkins controller file system are affected by CVE-2025-64146.
What is the potential impact of CVE-2025-64146?
The potential impact of CVE-2025-64146 includes unauthorized access to API keys, which can lead to further security breaches.