CVE-2025-67642: Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

December 10, 2025

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

References

github.com/advisories/GHSA-3fm2-hx3h-xm4v
github.com/jenkinsci/hashicorp-vault-plugin
nvd.nist.gov/vuln/detail/CVE-2025-67642
www.jenkins.io/security/advisory/2025-12-10/

Code Behaviors & Features

Detect and mitigate CVE-2025-67642 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →