CVE-2025-53668

Vulnerability

Overview

Jenkins VAddy Plugin versions 1.2.8 and earlier store Vaddy API authentication keys unencrypted in job config.xml files on the Jenkins controller [1][3]. This plaintext storage violates the principle of securing credentials at rest, making the keys accessible to any user or process that can read those configuration files [3].

Exploitation

Prerequisites

An attacker must have either the Item/Extended Read permission on a Jenkins job or direct access to the Jenkins controller's file system to retrieve the stored keys [1][2]. No special authentication against the VAddy service is required at the point of access; the exposure is entirely within Jenkins's storage mechanism [3].

Impact

With the exposed VAddy API Auth Key, an attacker could perform actions authorized by that key against the VAddy web security testing service, potentially compromising test configurations, results, or related infrastructure [1]. The vulnerability is rated with a CVSS v4.0 score as of the advisory date, though NVD has not yet provided its own assessment [3].

Mitigation

Status

As of the 2025-07-09 security advisory, Jenkins has acknowledged this vulnerability but notes that the VAddy Plugin remains unresolved, meaning no patch is yet available [1][2]. Users should restrict Item/Extended Read permissions and limit file system access to the Jenkins controller as interim workarounds [1][2][4].