CVE-2025-53743

Vulnerability

Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier do not properly mask (replace with asterisks) the Applitools API key when it is displayed on the job configuration form [1][3]. This occurs because the plugin does not apply standard credential masking to the API key field, leaving the secret value visible in plain text [3].

Exploitation

An attacker with access to view job configuration pages—such as a user with Job/Configure permission or read access to the config.xml file—can directly observe the plaintext API key [1]. No special network position or additional authentication bypass is required beyond existing Jenkins authorization to see the configuration form [2].

Impact

Exposure of the Applitools API key allows an attacker to impersonate the legitimate Jenkins instance when communicating with the Applitools Eyes service [1][4]. This could enable unauthorized access to test results, modification of visual test baselines, or even data exfiltration depending on the Applitools account permissions [1].

Mitigation

Jenkins has released Applitools Eyes Plugin version 1.16.6 which masks the API key in configuration forms [2]. Users are strongly advised to upgrade to this version immediately [1][2]. After upgrading, any previously exposed keys should be rotated in the Applitools account [4].