Executive brief
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Affected products
- Maven com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Junglewise Threat Intelligence
CVE-2025-67642: Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
CVE-2025-67642 · Severity: low · CVSS 3.1 · Published 2025-12-10
Technologies: com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven). Vendors: Maven.
Related threats
- Jenkins HashiCorp Vault Plugin has improper masking of credentials
- Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
- Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
- Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files
- Improper credentials masking in Jenkins HashiCorp Vault Plugin