CVE-2025-64143
Medium · 4.3Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files
CVSS
4.3
EPSS
0.2%
Published
Oct 29, 2025
CISA due date
—
The record
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.openshift.jenkins:openshift-pipeline | 0 | No fix |
Related vulnerabilities
- GHSA-4653-9q2r-684q Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job… Same vulnerability
- CVE-2026-111063 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-311
- CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted… CWE-311
- CVE-2026-81688 openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in… CWE-311
- CVE-2026-81681 openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB… CWE-311
- CVE-2026-19891 A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. CWE-311
- CVE-2026-21079 Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows… CWE-311
- CVE-2026-20157 As part of Cisco's ongoing commitment to proactive security and product quality, the… CWE-311