# CVE-2025-67639: Jenkins has a CSRF vulnerability on the login form

Source: https://junglewise.ai/threats/cve-2025-67639-jenkins-has-a-csrf-vulnerability-on-the-login-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10  
License: CC BY 4.0 with a link back

CVE-2025-67639 · Severity: low · CVSS 3.5 · Published 2025-12-10

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-67639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67639 being exploited in the wild.

**How severe is CVE-2025-67639?** Low severity, with a CVSS score of 3.5, published 10 December 2025.

**Which products and versions are affected?** org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541.

**Is there a fix for CVE-2025-67639?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.541 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-67639?** Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.541 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.541 in your pom.xml or build.gradle
  ```


## Affected products

- Jenkins
- org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541

## Identifiers

- CVE-2025-67639
- GHSA-6837-qgrc-x5p6

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)