CVE-2025-64143

Vulnerability

Description The Jenkins OpenShift Pipeline Plugin up to version 1.0.57 stores authorization tokens (used for authenticating to the OpenShift API) in plaintext within job config.xml files on the Jenkins controller [2][4]. This is a case of insecure storage of sensitive data, as the tokens are not encrypted or masked.

Exploitation

To exploit this vulnerability, an attacker needs either the Item/Extended Read permission on a Jenkins job (which allows viewing job configuration) or direct access to the Jenkins controller's file system [2][4]. No authentication to OpenShift is required; the tokens are already present in the Jenkins configuration.

Impact

If successful, an attacker can retrieve the authorization tokens and use them to authenticate to the OpenShift cluster as the Jenkins service account. Depending on the permissions granted to that account, this could lead to unauthorized access to OpenShift resources, including the ability to deploy pods, modify configurations, or access secrets [2].

Mitigation

As of the Jenkins Security Advisory 2025-10-29, no fix has been released for this vulnerability; it is listed as unresolved [3]. Users are advised to restrict Item/Extended Read permissions to trusted users and limit file system access to the Jenkins controller. Additionally, the plugin is deprecated for OpenShift versions after 3.11, and migration to the OpenShift Client Plugin is recommended [1].