CVE-2025-67637: Medium severity Jenkins Jenkins vulnerability
Published Dec 10, 2025
·Updated
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected Software
6 affected componentsFixes available
Jenkins Jenkins<2.540
Jenkins Jenkins LTS<2.528.2
maven/org.jenkins-ci.main:jenkins-core<2.528.3
2.528.3
maven/org.jenkins-ci.main:jenkins-core>=2.529<2.541
2.541
Jenkins Jenkins<2.528.3
Jenkins Jenkins<2.541
Event History
Dec 10, 2025
CVE Published
via MITRE·04:50 PM
Data Sourced
via MITRE·04:50 PM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Data Sourced
via GitHub·06:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67637?
CVE-2025-67637 is rated as a medium severity vulnerability.
2
How do I fix CVE-2025-67637?
To resolve CVE-2025-67637, you should upgrade to Jenkins version 2.541 or later, or LTS version 2.528.3 or later.
3
What types of data are exposed in CVE-2025-67637?
CVE-2025-67637 exposes build authorization tokens stored unencrypted in job config.xml files.
4
Who is affected by CVE-2025-67637?
Users with Item/Extended Read permission or access to the Jenkins controller file system are affected by CVE-2025-67637.
5
What are the implications of CVE-2025-67637?
If exploited, CVE-2025-67637 may allow unauthorized access to sensitive build authorization tokens.