Unencrypted Key Exposure in Jenkins IFTTT Build Notifier Plugin
CVE-2025-53662
6.5MEDIUM
Key Information:
- Vendor
Jenkins
- Vendor
- CVE Published:
- 9 July 2025
What is CVE-2025-53662?
The IFTTT Build Notifier Plugin for Jenkins has a significant security flaw where Maker Channel Keys are stored in plaintext within job configuration files (config.xml) on the Jenkins controller. This exposure allows any user with Item/Extended Read permissions or those with access to the file system of the Jenkins controller to view sensitive information, thereby increasing the risk of unauthorized access and exploitation.
Affected Version(s)
Jenkins IFTTT Build Notifier Plugin 0 <= 1.2