Vulnerability in Jenkins HashiCorp Vault Plugin Allows Unauthorized Access to Credentials

CVE-2025-67642

What is CVE-2025-67642?

The Jenkins HashiCorp Vault Plugin, specifically version 371.v884a_4dd60fb_6 and earlier, exhibits a significant access control flaw. It fails to properly set the context needed for looking up Vault credentials, which permits users with Item/Configure permissions to access Vault credentials that should be restricted. This unauthorized access can lead to exploitation, allowing attackers to capture sensitive credentials potentially compromising the integrity and security of the Jenkins environment. Organizations using this plugin are advised to review their permission settings and upgrade to the fixed version to mitigate this issue.

References