Jenkins Windocks Plugin
CVE-2025-64139
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Overall/Read account
-
ExploitInvoke plugin endpoint with attacker URL
-
ExecutionController issues server-side request
-
ImpactReach internal/unintended service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Start Windocks Containers Plugin version 1.4 or earlier to be installed on the Jenkins controller, and the attacker must hold an authenticated Jenkins account with at least the Overall/Read permission (the baseline authenticated permission, per the CVSS PR:L). Exploitation is network-reachable with low complexity and no user interaction, but is LIMITED to users who can already authenticate - anonymous/unauthenticated exploitation is not indicated. Impact is bounded to coercing the controller into outbound connections (SSRF), not direct code execution, with no stated confidentiality or availability impact. |
| Impact | This is a genuine-but-low-priority issue, and the signals are mutually consistent rather than conflicting. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but it requires an authenticated account (PR:L) and yields only a limited integrity impact (I:L) with no confidentiality or availability impact. This matches CWE-862 (Missing Authorization): a user holding only the baseline Overall/Read permission can coerce the Jenkins controller into connecting to an attacker-specified URL (a server-side request forgery primitive). The exploitation-likelihood signals agree with the modest severity: EPSS is 0.25% (15th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code is referenced in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' Nothing here warrants emergency prioritization; it is a patch-in-normal-cycle item. The main nuance is scope: because the attacker must already hold a Jenkins account with Overall/Read, real-world risk is concentrated in multi-user Jenkins instances where low-trust users can authenticate, and the impact is an SSRF pivot rather than direct code execution or data theft. |
| Exploit ScenarioDerived | An attacker who already has a low-privilege Jenkins account (Overall/Read) sends a crafted request to the Start Windocks Containers Plugin endpoint specifying an arbitrary URL. The Jenkins controller then connects to that URL on the attacker's behalf, which can be abused to reach internal services or cloud metadata endpoints that are not directly accessible. No public proof-of-concept exploit is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Missing permission checks in Jenkins Start Windocks Containers Plugin 1.4 and earlier let any authenticated user holding the baseline Overall/Read permission force the Jenkins controller to make an outbound HTTP connection to a URL of the attacker's choosing, a classic server-side request forgery (SSRF) pattern with integrity-only impact. Only Jenkins instances with the plugin installed are affected; the Jenkins core itself is not vulnerable, and exploitation requires a valid account with at least read-level access, so anonymous or unauthenticated attacks are not indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3). Severity signals are mutually consistent and point to a genuine-but-low-priority issue: EPSS is just 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating active exploitation.
RemediationAI
No vendor-released patch is identified in the provided data - no fixed plugin version is listed, and no GitHub PR or commit is referenced - so treat the Jenkins advisory at https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531 as the authoritative source for a fix and re-check it before assuming one exists. The most effective immediate mitigation is to uninstall or at minimum disable the Start Windocks Containers Plugin on any controller that does not actively need Windocks container provisioning; the trade-off is loss of that integration, which is acceptable for most Jenkins installations since the plugin is narrowly scoped. If the plugin must remain, restrict the Overall/Read permission to trusted accounts only (this does not eliminate the flaw but shrinks the pool of users who can reach the unguarded endpoint), and apply egress filtering on the Jenkins controller so outbound HTTP/HTTPS is limited to an allowlist of expected hosts - cheaper to manage but with the trade-off that it can break legitimate plugin and pipeline network calls if the allowlist is too tight. Running the controller behind a segmented network with no route to cloud metadata services (for example, blocking 169.254.169.254) reduces SSRF blast radius at essentially no functional cost. Note that disabling or removing the plugin requires a Jenkins restart to fully take effect, and permission changes should be validated against existing job and pipeline definitions to avoid breaking legitimate builds.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): a plugin HTTP endpoint that should be gated behind a stronger Jenkins permission performs its action after verifying only the baseline Overall/Read permission, if anything. Because the endpoint accepts a user-supplied URL and the Jenkins controller performs the request server-side, an attacker who can reach that endpoint converts their low-privilege read access into a request forged from the controller's network position - useful for probing internal services, cloud metadata endpoints, or internal-only HTTP APIs that are not directly reachable from the attacker's network. The CPE string cpe:2.3:a:jenkins:start_windocks_container:*:*:*:*:*:jenkins:*:* identifies the vulnerable component as the Start Windocks Containers Plugin (a Jenkins Update Center plugin that integrates Windows-container provisioning via Windocks into Jenkins jobs), scoped to the 'jenkins' platform, not Jenkins core. The CVSS vector's scope-unchanged (S:U), integrity-low (I:L), and no-confidentiality/availability-impact (C:N/A:N) components bound the realistic effect to unwanted outbound connections rather than credential disclosure, code execution, or denial of service, which is consistent with the plugin's functionality rather than with an injection or deserialization flaw. The Jenkins security team is credited as the reporter via jenkinsci-cert@googlegroups.com, and SECURITY-3531 is the tracking identifier in the 2025-10-29 Jenkins security advisory.
Know when Start Windocks Container gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable, low-complexity SSRF requiring a baseline authenticated account (PR:L); limited integrity impact from forced outbound requests, with no confidentiality or availability effect.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB