Unencrypted API Key Exposure in Jenkins Cadence vManager Plugin

CVE-2025-31724

What is CVE-2025-31724?

The Jenkins Cadence vManager Plugin prior to version 4.0.0-282.v5096a_c2db_275 has a serious vulnerability where Verisium Manager vAPI keys are stored unencrypted within the job config.xml files located on the Jenkins controller. This flaw allows users with Extended Read permission, or those with access to the Jenkins controller file system, to easily view the sensitive API keys. This exposure poses significant risks, especially in a multi-user environment where unauthorized users might exploit this access to gain control over API interactions.

References