CVE-2025-53672

Vulnerability

Description

The Jenkins Kryptowire Plugin, versions 0.2 and earlier, stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller [1][3]. This plaintext storage violates security best practices for handling credentials, leaving the API key accessible to anyone who can read the Jenkins controller's file system [1][2].

Exploitation

Path

To exploit this vulnerability, an attacker must have access to the Jenkins controller's file system [1][3]. This could be achieved by a malicious insider with file read permissions, or through another vulnerability that allows file access [2]. No network-based attack vector is described; the exposure depends on the attacker's ability to read files on the controller [3].

Impact

An attacker who retrieves the unencrypted API key can impersonate the Jenkins instance to the Kryptowire platform, potentially accessing sensitive data or performing unauthorized actions on behalf of the plugin [1][3]. The impact is limited to the functionality and data accessible via that API key.

Mitigation

Status

As of the advisory publication on July 9, 2025, the vulnerability remains unresolved in the Kryptowire Plugin; the Jenkins Security Advisory lists it among plugins with unresolved security issues [2]. No patch version is available, and users are advised to restrict file system access to the Jenkins controller as a workaround [1][2].