~ / search / GHSA-3fm2-hx3h-xm4v

GHSA-3fm2-hx3h-xm4v

Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-67642

Packages

EcosystemPackageAffectedFixed in
Maven com.datapipe.jenkins.plugins:hashicorp-vault-plugin <= 371 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

References

External links from the advisory. They lead to third-party sites.