GHSA-9768-hprv-crj5

Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53650

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:credentials-binding	< 687.689.v1a	687.689.v1a

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log. Credentials Binding Plugin 687.689.v1a_f775332fc9 rethrows exceptions that contain credentials, masking those credentials in the error messages.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-53650 advisory
https://github.com/jenkinsci/credentials-binding-plugin package
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3499 web
http://www.openwall.com/lists/oss-security/2025/07/09/4 web