Nexus Task Runner
CVE-2025-64141
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated Jenkins user to malicious page
-
ExploitBrowser auto-submits forged CSRF request
-
ExecutionPlugin connects to attacker URL with attacker credentials
-
ImpactValidate attacker-controlled Nexus endpoint reached
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user with a valid active session (typically one holding Overall/Configure or job-configuration permission for the Nexus Task Runner plugin) to be tricked into loading attacker-controlled web content while logged in, because the forged request rides the victim's existing session. Limiting factors: this is a CSRF flaw (CWE-352), so it needs victim interaction (visiting a malicious page) and a concurrently authenticated session; it cannot be driven by a fully unauthenticated attacker acting alone, and Jenkins instances with up-to-date CSRF crumb protection or the plugin patched beyond 0.9.2 are not affected. Impact is limited to causing an outbound connection to an attacker-specified URL with attacker-specified credentials, not direct code execution or data disclosure. |
| Impact | This is a moderate, not a high-priority, issue. All signals point to low real-world urgency: the input CVSS base score is 4.3 (MEDIUM), EPSS is only 0.21% at the 10th percentile (very low predicted exploitation probability), the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is referenced - only the Jenkins security advisory and an oss-security mailing-list post. The supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) is internally questionable for a CWE-352 CSRF flaw: CSRF by definition relies on tricking an already-authenticated victim's browser into issuing a forged request, which normally maps to PR:N/UI:R, not PR:L/UI:N. The input vector should be verified against the Jenkins advisory, as the PR/UI metrics appear mislabeled for a CSRF class issue. No SSVC decision data was provided. Net assessment: a genuine but low-severity, low-probability flaw affecting a niche Jenkins plugin; patch on normal cadence rather than treating as an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page and lures a logged-in Jenkins user (ideally one with permissions to configure tasks) into visiting it; the page silently submits a forged request to the victim's Jenkins instance, causing the Nexus Task Runner plugin to connect to an attacker-specified URL using attacker-supplied credentials. No public exploit code is identified at time of analysis, and because the attack vector is network-based with low complexity it is technically simple, though it depends on victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-site request forgery in the Jenkins Nexus Task Runner Plugin 0.9.2 and earlier lets an attacker force an outbound connection to an attacker-specified URL using attacker-specified credentials, riding the session of a logged-in Jenkins user who is tricked into loading hostile web content. Successful abuse requires victim interaction plus a concurrently authenticated Jenkins session holding the relevant configuration permissions, and the impact is limited to unauthorized outbound requests and credential use rather than code execution or data disclosure. EPSS is low at roughly 0.21% (10th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
RemediationAI
The primary fix is to upgrade the Jenkins Nexus Task Runner Plugin beyond 0.9.2 to the fixed release documented in the Jenkins security advisory for 2025-10-29 (SECURITY-3550, https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550); the reference data does not state the exact fixed version number, so confirm it in the advisory before upgrading. If the plugin is not required, uninstall or disable it, which fully removes the attack surface at the cost of losing whatever task-runner integration it provided. Verify that Jenkins CSRF crumb protection is enabled (it is on by default in current Jenkins releases but can be disabled on legacy configurations) and consider re-enabling it; the trade-off is that scripts and API clients that do not supply crumbs will start failing until they are updated. Restrict who holds Overall/Configure and job-configuration permissions, since the forged request depends on a privileged logged-in session. Where feasible, constrain outbound network egress from the Jenkins controller so requests to arbitrary external URLs cannot succeed, noting this will break legitimate external integrations. Finally, because the forged request transmits credentials to an attacker-chosen URL, audit and rotate any credentials configured in Jenkins that could have been sent in this manner.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-352 cross-site request forgery in a Jenkins plugin. The Nexus Task Runner plugin exposes configuration functionality that accepts a target URL and a set of credentials; because the Jenkins web UI authenticates users primarily via session cookies, a state-changing request to that endpoint can be replayed from a malicious page the victim visits while logged in, unless it is protected by a per-request CSRF crumb/token tied to the user's session. The affected component is identified by CPE cpe:2.3:a:jenkins:nexus_task_runner:*:*:*:*:*:jenkins:*:*, confirming the Jenkins plugin channel as the delivery vector. The root cause is missing or insufficient anti-CSRF validation on a request handler that consumes attacker-influenced parameters (URL and credentials), which the plugin then uses to initiate an outbound connection. Jenkins releases its own security advisories through its CERT contact (jenkinsci-cert@googlegroups.com) and separate advisories per plugin release train, including SECURITY-3550 for this finding.
Know when Nexus Task Runner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CSRF needs no attacker privileges (PR:N) but requires the authenticated victim to interact with attacker content (UI:R); impact is limited integrity (I:L) from a forced outbound connection, with no confidentiality or availability effect.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
GitHub PoC
Exploit-DB