CVE-2025-53650: Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

July 9, 2025 (updated November 5, 2025)

Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.

Credentials Binding Plugin 687.689.v1a_f775332fc9 rethrows exceptions that contain credentials, masking those credentials in the error messages.

References

github.com/advisories/GHSA-9768-hprv-crj5
github.com/jenkinsci/credentials-binding-plugin
nvd.nist.gov/vuln/detail/CVE-2025-53650
www.jenkins.io/security/advisory/2025-07-09/

Code Behaviors & Features

Detect and mitigate CVE-2025-53650 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →