How to fix CVE-2025-58460?

During next maintenance window: Identify affected systems running Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earl and apply vendor patches when convenient. Monitor vendor channels for patch availability.

Is Opentelemetry affected by CVE-2025-58460?

CVE-2025-58460 presents moderate security risk, a missing authorization vulnerability rated CVSS 4.2. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.

CVE-2025-58460

MEDIUM

2025-09-03 [email protected]

4.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch Released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 19:10 vuln.today

CVE Published

Sep 03, 2025 - 15:15 nvd

MEDIUM 4.2

Description

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Analysis

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. No vendor patch available.

Technical Context

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Affected products include: Jenkins Opentelemetry.

Affected Products

Jenkins Opentelemetry.

Remediation

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +21

POC: 0

CVE-2025-58460 vulnerability details – vuln.today

Back

CVE-2025-58460

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-58460

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code