What is GHSA-hxjg-2jvf-h3rx?

GHSA-hxjg-2jvf-h3rx is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins's build authorization token is stored and displayed in plain text

Which CVE IDs does GHSA-hxjg-2jvf-h3rx cover?

GHSA-hxjg-2jvf-h3rx covers the following CVE IDs: CVE-2025-67638. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hxjg-2jvf-h3rx?

GHSA-hxjg-2jvf-h3rx has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hxjg-2jvf-h3rx?

GHSA-hxjg-2jvf-h3rx affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.529, \u003c 2.541; maven/org.jenkins-ci.main:jenkins-core:\u003c 2.528.3.

GHSA-hxjg-2jvf-h3rxMediumCVSS 4.3

Jenkins's build authorization token is stored and displayed in plain text

Vendor

GitHub Security Advisories

Published

December 10, 2025

Last Modified

December 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-67638 →

📋 Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 2.529, < 2.541
maven/org.jenkins-ci.main:jenkins-core:< 2.528.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-67638
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783
https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981
https://github.com/advisories/GHSA-hxjg-2jvf-h3rx