CVE-2025-64146

Vulnerability

Description The Jenkins Curseforge Publisher Plugin versions 1.0 stores API keys in plaintext within job configuration files (config.xml) on the Jenkins controller. This lack of encryption means the sensitive credentials are persisted without any protection, violating best practices for secret storage in Jenkins plugins [1][3].

Attack

Surface Exploitation requires an attacker to have either the Item/Extended Read permission on a job or direct access to the Jenkins controller's file system. No other privileges are needed to retrieve the stored API keys from the configuration files [1][3].

Impact

An attacker who obtains the API keys can use them to authenticate to the Curseforge service on behalf of the plugin user, potentially gaining unauthorized access to Curseforge projects, modifying content, or exfiltrating data [1][2].

Mitigation

As of the advisory date, no fix has been released for this vulnerability; it is listed as an unresolved security issue in the plugin [2]. Users should apply strict access controls on the Jenkins controller and restrict Item/Extended Read permissions to trusted users only, as a workaround until a plugin update becomes available [1][2].