---
id: CVE-2025-67638
title: >-
  Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build
  authorization tokens displayed on the job configuration form, increasing the
  potential for attackers to observe and capture them.
summary: >-
  Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build
  authorization tokens displayed on the job configuration form, increasing the
  potential for attackers to observe and capture them.
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-312
vendor: jenkins
product: jenkins
affected:
  - jenkins < 2.528.3
  - jenkins < 2.541
patched:
  - jenkins 2.541
published: '2025-12-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67638'
references:
  - url: 'https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783'
    label: jenkinsci-cert@googlegroups.com
tags:
  - nvd
epss: 0.00159
epssPercentile: 0.04611
ingestedAt: '2026-10-14T21:57:04.788Z'
---

## Overview

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

## Affected

- `jenkins < 2.528.3`
- `jenkins < 2.541`

## Remediation

Upgrade past the affected range:

- `jenkins 2.541`