---
id: CVE-2025-67637
title: >-
  Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization
  tokens unencrypted in job config.xml files on the Jenkins controller where
  they can be viewed by users with Item/Extended Read permission or access to
  the Jenk…
summary: >-
  Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization
  tokens unencrypted in job config.xml files on the Jenkins controller where
  they can be viewed by users with Item/Extended Read permission or access to
  the Jenk…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-312
vendor: jenkins
product: jenkins
affected:
  - jenkins < 2.528.3
  - jenkins < 2.541
patched:
  - jenkins 2.541
published: '2025-12-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67637'
references:
  - url: 'https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783'
    label: jenkinsci-cert@googlegroups.com
tags:
  - nvd
epss: 0.00181
epssPercentile: 0.07179
ingestedAt: '2026-10-14T21:57:04.788Z'
---

## Overview

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

## Affected

- `jenkins < 2.528.3`
- `jenkins < 2.541`

## Remediation

Upgrade past the affected range:

- `jenkins 2.541`