CVE-2025-58460
📋 TL;DR
The Jenkins OpenTelemetry Plugin vulnerability allows attackers with Overall/Read permission to exfiltrate Jenkins credentials by connecting to attacker-controlled URLs. This affects Jenkins instances using vulnerable plugin versions, potentially exposing stored credentials to unauthorized users.
💻 Affected Systems
- Jenkins OpenTelemetry Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal all Jenkins credentials, leading to complete system compromise, lateral movement, and data exfiltration.
Likely Case
Attackers capture specific credentials they target, potentially gaining access to downstream systems or sensitive data.
If Mitigated
Limited credential exposure if proper access controls and network segmentation are in place.
🎯 Exploit Status
Requires attacker to have Overall/Read permission and obtain credentials IDs through other means.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenTelemetry Plugin 3.1544.v8446b_92b_cd65 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602
Restart Required: No
Instructions:
1. Navigate to Jenkins Manage Jenkins > Manage Plugins. 2. Update OpenTelemetry Plugin to version 3.1544.v8446b_92b_cd65 or later. 3. No restart required.
🔧 Temporary Workarounds
Restrict Overall/Read Permissions
allLimit Overall/Read permission to trusted users only to reduce attack surface.
Disable OpenTelemetry Plugin
allTemporarily disable the plugin if not essential for operations.
🧯 If You Can't Patch
- Implement strict access controls to limit Overall/Read permission to essential users only.
- Monitor for unusual outbound connections from Jenkins to external URLs.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for OpenTelemetry Plugin version. If version is 3.1543.v8446b_92b_cd64 or earlier, system is vulnerable.Check Version:
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab, search for OpenTelemetry Plugin.Verify Fix Applied:
Verify OpenTelemetry Plugin version is 3.1544.v8446b_92b_cd65 or later in Jenkins plugin manager.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Jenkins to external domains
- Failed authentication attempts for credential access
Network Indicators:
- Outbound connections from Jenkins to unfamiliar domains on standard HTTP/HTTPS ports
SIEM Query:
source="jenkins.log" AND ("OpenTelemetry" OR "outbound" OR "credential") AND ("error" OR "failed" OR "unauthorized")