CVE-2025-53667

The Jenkins Dead Man's Snitch Plugin version 0.1 does not mask the Dead Man's Snitch token when displayed on the job configuration form. Instead of showing asterisks, the token is shown in plaintext, making it visible to anyone who can view the configuration page [1].

An attacker with Job/Configure permission (a standard Jenkins permission) can navigate to the job configuration form and see the token directly. No additional privileges or network position is required, as the token is exposed within the Jenkins UI to authorized users [2].

If an attacker captures the Dead Man's Snitch token, they could potentially disable monitoring or send false heartbeat signals, undermining the reliability of external cron job monitoring that relies on these tokens. This could lead to undetected failures or false alerts [1].

As of the July 2025 advisory, the Dead Man's Snitch Plugin has an unresolved security issue, meaning no patched version is available. Users are advised to avoid using this plugin or restrict access to job configuration forms to trusted users only until a fix is released [2].