Eggplant Runner Plugin CVE-2025-64135

Exploitation requires that the Jenkins controller/agent running the Eggplant Runner Plugin (version 0.0.1.301.v963cffe8ddb_8 or earlier) performs outbound HTTPS connections through an HTTP proxy that uses Basic authentication over the CONNECT tunnel - the setting of jdk.http.auth.tunneling.disabledSchemes to empty only matters when such proxy tunneling with Basic auth is in use. The decisive limiting factor is that the attacker must already hold a privileged man-in-the-middle position on the network path between Jenkins and the proxy to observe the re-enabled Basic auth exchange (reflected by AC:H); if no proxy is configured, or the proxy does not use Basic authentication, the credential-exposure impact does not materialize. No authentication to Jenkins and no user interaction are required (PR:N/UI:N).

This is a genuinely moderate, not high, priority. The CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) is driven entirely by a High confidentiality impact, but it is heavily tempered by High attack complexity (AC:H), which reflects the need for a privileged network/man-in-the-middle position to actually capture the exposed credentials - the flaw itself only disables a Java safeguard rather than directly leaking data. Corroborating signals point to low real-world urgency: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing, and no public exploit code is referenced. All signals are consistent with each other - low probability, no active exploitation, high complexity - so there is no conflict to flag; this is a configuration-weakening/information-disclosure issue rather than a direct RCE or auth-bypass. One caveat: the Confidentiality:High rating is somewhat generous for a vuln that merely re-enables Basic auth over HTTPS proxy tunnels and depends on a secondary MITM condition to realize impact; defenders relying on a proxy for the plugin's outbound connections should treat it more seriously than those not using a proxy at all.

A Jenkins instance running the Eggplant Runner Plugin makes outbound HTTPS connections through an HTTP proxy; because the plugin blanks out jdk.http.auth.tunneling.disabledSchemes, the JVM will again perform Basic authentication during the proxy CONNECT tunnel, transmitting credentials in a weakly-protected manner. An attacker positioned on the network path between Jenkins and its proxy (the condition reflected by AC:H) intercepts the proxy tunnel handshake and recovers the Basic auth credentials. No public proof-of-concept exploit is referenced for this specific issue.