CVE-2025-67642
📋 TL;DR
The Jenkins HashiCorp Vault Plugin vulnerability allows attackers with Item/Configure permission to access Vault credentials they shouldn't have access to, potentially capturing sensitive secrets. This affects Jenkins instances using the vulnerable HashiCorp Vault Plugin versions.
💻 Affected Systems
- Jenkins HashiCorp Vault Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate all Vault credentials accessible to Jenkins, compromising secrets management and potentially gaining access to other systems.
Likely Case
Privileged Jenkins users could access Vault credentials beyond their intended scope, leading to unauthorized access to secrets.
If Mitigated
With proper permission controls and monitoring, impact is limited to credential exposure within the Jenkins environment.
🎯 Exploit Status
Exploitation requires existing Jenkins user permissions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 372.v884a_4dd60fb_7 or later
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3045
Restart Required: Yes
Instructions:
1. Update Jenkins HashiCorp Vault Plugin to version 372.v884a_4dd60fb_7 or later
2. Restart Jenkins instance
3. Verify plugin version in Jenkins plugin manager
🔧 Temporary Workarounds
Restrict Item/Configure Permissions
allTighten Jenkins permission controls to limit users with Item/Configure access
Audit Vault Credential Usage
allReview and monitor access to Vault credentials in Jenkins
🧯 If You Can't Patch
- Restrict Jenkins user permissions to minimum required
- Implement additional monitoring for Vault credential access patterns
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for HashiCorp Vault Plugin version 371.v884a_4dd60fb_6 or earlierCheck Version:
Navigate to Jenkins > Manage Jenkins > Plugin Manager > Installed pluginsVerify Fix Applied:
Confirm plugin version is 372.v884a_4dd60fb_7 or later in Jenkins plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual Vault credential access patterns
- Multiple failed credential lookups from same user
Network Indicators:
- Increased Vault API calls from Jenkins instance
SIEM Query:
source="jenkins.log" AND ("Vault" OR "credential") AND ("access" OR "lookup")