CVE-2025-67642 Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

What is CVE-2025-67642?

CVE-2025-67642 is a medium-severity missing authorization vulnerability in Jenkins HashiCorp Vault Plugin, published on 10 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Weakness: CWE-282

Which versions are affected by CVE-2025-67642?

2 open source packages ship an affected version, including com.datapipe.jenkins.plugins:hashicorp-vault-plugin. It affects 1 product.

Products include Jenkins Hashicorp Vault.

How do I fix CVE-2025-67642?

No fix has been published for CVE-2025-67642 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-67642 being exploited?

There is no known exploitation of CVE-2025-67642 in the wild and no public exploit code.

Other vulnerabilities in Jenkins HashiCorp Vault Plugin

• CVE-2023-33001 Jenkins HashiCorp Vault Plugin has improper masking of credentials High 7.5
• CVE-2022-36888 Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests Medium 6.5
• CVE-2022-25186 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin Medium 6.5
• CVE-2022-25197 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files Medium 6.5
• CVE-2022-23109 Improper credentials masking in Jenkins HashiCorp Vault Plugin Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fm2-hx3h-xm4v.