CVE-2025-53668

EUVD-2025-20846 · Published Jul 9, 2025

Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Technologies

Jenkins Vaddy

Weaknesses

CWE-311

CVSS scores

v3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Credential Access Discovery Collection

T1190Exploit Public-Facing Application T1005Data from Local System T1040Network Sniffing T1056.004Credential API Hooking T1111Multi-Factor Authentication Interception T1539Steal Web Session Cookie T1552.004Private Keys

References

https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527
http://www.openwall.com/lists/oss-security/2025/07/09/4
https://nvd.nist.gov/vuln/detail/CVE-2025-53668
https://github.com/jenkinsci/vaddy-plugin

Potentially impacted assets

See if this affects your attack surface