ByteGuard Build Actions CVE-2025-64144

The ByteGuard Build Actions Plugin 1.0 must be installed and in use with configured API tokens, which are then written in cleartext to job config.xml on the controller. Exploitation requires EITHER a Jenkins account holding Item/Extended Read permission on the affected job(s), OR read access to the Jenkins controller filesystem (e.g., via backups, shared storage, or a shell on the host). Limiting factors: this is authenticated (PR:L) - an anonymous remote attacker cannot reach the token without first obtaining Extended Read or filesystem access; impact is confined to disclosure of whatever external service the stored API token authenticates to; and it depends on the non-default condition that this specific plugin is deployed and tokens have been entered.

This is a genuinely low-priority issue despite being a real vulnerability. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only information disclosure requiring authenticated access, and all secondary signals agree rather than conflict: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified. The exposure requires an attacker to already hold at least Item/Extended Read permission on the Jenkins controller or have filesystem access, meaning this is a privilege-boundary/defense-in-depth weakness (an insider or a lower-trust user escalating access to secrets) rather than a remotely exploitable, unauthenticated flaw. No SSVC decision data was provided in the input. The PR:L in the vector is consistent with the description's requirement for Item/Extended Read permission, so the signals are coherent. Net assessment: a legitimate secret-hygiene defect worth patching during normal maintenance, but not an emergency - the combination of required authentication, low impact, negligible EPSS, and absence of KEV/POC all point to low real-world risk.

A Jenkins user who has been granted Item/Extended Read permission on a job (but not full administrative rights) views the job's config.xml and reads the plaintext API token stored by the ByteGuard Build Actions plugin, then reuses that token to authenticate to the downstream service the token grants access to. Alternatively, anyone with read access to the controller's filesystem (e.g., backups, a compromised low-privilege shell) can harvest the tokens from the on-disk config. No public exploit code is required - the data is simply readable in cleartext.