Jenkins OpenShift Pipeline CVE-2025-64143

Exploitation requires that the OpenShift Pipeline Plugin (version 1.0.57 or earlier) be installed and configured on a job with an OpenShift authorization token, and that the attacker hold the Jenkins Item/Extended Read permission on that job OR have read access to the Jenkins controller filesystem where config.xml resides. These are the limiting factors: the attacker must already be authenticated to Jenkins with that specific granted permission (not anonymous/unauthenticated), and a token must actually be configured. There is no remote unauthenticated path and no code execution - it is purely reading a cleartext secret from a configuration file that is accessible to users who should not necessarily see stored credentials.

This is a low-to-moderate priority information disclosure flaw, not an urgent one. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) tells a consistent story: network-reachable via the Jenkins web UI, low attack complexity, but requiring an authenticated user already holding Item/Extended Read permission (PR:L), with only limited confidentiality impact and no integrity or availability effect. All signals point in the same low-risk direction rather than conflicting: EPSS is 0.20% (9th percentile), indicating very low predicted exploitation likelihood; there is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. The real-world risk is bounded by the fact that an attacker must already be a semi-trusted Jenkins user (or have controller filesystem access) - this is primarily a privilege-escalation/lateral-movement concern where a low-privileged user harvests OpenShift authorization tokens they should not see. One caveat: CVSS scores only Confidentiality as Low, but the disclosed asset is an authorization token whose downstream misuse against the connected OpenShift cluster could exceed what the base CVSS suggests; defenders should weigh the sensitivity of the leaked credential, not just the 4.3 score.

A low-privileged Jenkins user who has been granted Item/Extended Read on a job (or any user with read access to the controller filesystem) opens or fetches the job's config.xml and reads the OpenShift authorization token stored there in cleartext. They then reuse that token to authenticate to the OpenShift cluster with the privileges of the pipeline's service account. No public exploit code is required - this is trivial reading of a configuration file over an authenticated session (AV:N/AC:L/PR:L).