Jenkins Curseforge Publisher
CVE-2025-64146
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Item/Extended Read permission
-
ExploitOpen job config.xml
-
ExecutionRead unencrypted CurseForge API key
-
ImpactAbuse key on CurseForge account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encryption of sensitive data
|
| Exploitation Conditions | Exploitation requires that a CurseForge API key has actually been configured in a Jenkins job using the Curseforge Publisher Plugin 1.0, since the secret is written to that job's config.xml on the controller. An attacker must additionally hold Jenkins Item/Extended Read permission on the job (PR:L) OR have read access to the Jenkins controller filesystem; without one of these the plaintext key is not reachable. Limiting factors: this is an at-rest disclosure with no code execution, no integrity or availability impact, and no privilege escalation within Jenkins - the realistic blast radius is confined to the exposed CurseForge API key and whatever that key authorizes on CurseForge. |
| Impact | This is a genuinely low-priority issue despite being network-accessible. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) tells a consistent story: although the attack vector is network (AV:N, via the Jenkins web UI), exploitation requires existing authenticated access with Item/Extended Read permission (PR:L), and impact is limited to low confidentiality only (C:L/I:N/A:N) - exposure of a CurseForge API key. EPSS reinforces low urgency at 0.17% (6th percentile), indicating very low probability of exploitation activity. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no confirmed active exploitation. There is no SSVC data provided. The signals do not conflict: a low-CVSS, low-EPSS, non-KEV secret-storage flaw requiring prior privileged access is a hygiene/hardening issue rather than an active threat. The only nuance is that the AV:N network vector overstates the real reach - the underlying weakness is an at-rest secret-storage flaw (CWE-311) requiring either Item/Extended Read permission or controller filesystem access, so practical risk is bounded by who already has those privileges. |
| Exploit ScenarioDerived | A low-privileged Jenkins user who holds Item/Extended Read permission (or anyone with read access to the controller filesystem) views a job's config.xml and recovers the CurseForge API key stored there in plaintext. The attacker then reuses that key to publish or manipulate content on the associated CurseForge account. No public exploit is required - this is simple retrieval of an unencrypted secret, consistent with the low-complexity (AC:L) vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cleartext storage of CurseForge API keys in Jenkins Curseforge Publisher Plugin 1.0 writes the secret in plaintext into each configured job's config.xml on the Jenkins controller, allowing users who hold Item/Extended Read permission on that job - or anyone with read access to the controller filesystem - to retrieve the key. The issue is remote and network-reachable but requires low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3), is an information-disclosure-only condition with no code execution or integrity/availability impact, and there is no public exploit identified at time of analysis and no confirmed active exploitation (EPSS 0.17%, 6th percentile). Realistic exposure is limited to the confidentiality of the CurseForge API key and whatever that key authorizes on CurseForge, and only when a key has actually been configured in a job.
RemediationAI
Treat any CurseForge API key configured in a Curseforge Publisher 1.0 job as compromised: rotate/revoke it in CurseForge and, if the key authorized sensitive projects, review its activity. Apply the vendor's plugin update identified in the Jenkins security advisory 2025-10-29 (SECURITY-3562) at https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562 - no specific fixed version number is provided in the supplied intelligence, so confirm the patched release directly in that advisory before upgrading, then restart the controller with the updated .hpi. As interim compensating controls, tighten Jenkins authorization so Item/Extended Read is granted only to trusted users (this reduces the audience able to read config.xml through the UI but does not protect against filesystem access), and restrict shell/OS-level read access to $JENKINS_HOME/jobs/**/config.xml on the controller, since any local reader can recover the plaintext key. Note that neither workaround removes the plaintext secret from already-written config.xml files; only rotating the key after the plugin update eliminates the exposure, and stripping or manually editing the stored value in config.xml risks breaking existing job configurations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-311 (Missing Encryption of Sensitive Data). Jenkins plugins are expected to persist secrets using Jenkins' own secret-encryption facilities - typically by declaring fields as hudson.util.Secret (or by storing the value in the Jenkins credentials store) so the value is encrypted with the controller's master key before being serialized into job configuration. Instead, Curseforge Publisher Plugin 1.0 writes the CurseForge API key as an unencrypted string into the plugin's section of the job's config.xml, which is the XML configuration file Jenkins maintains for every job on the controller. Because config.xml is readable by any principal granted Item/Extended Read on the job and is also a plain file on the controller's disk, the secret is exposed through two independent paths that both map to the same missing-encryption root cause. The CPE cpe:2.3:a:jenkins:curseforge_publisher:1.0:*:*:*:*:jenkins:*:* confirms that only version 1.0 of the plugin, running on a Jenkins controller, is in scope; the issue is a plugin-level configuration-storage defect rather than a flaw in Jenkins core or in CurseForge itself.
Know when Curseforge Publisher gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires an authenticated low-privileged user with Item/Extended Read (PR:L) over the web UI (AV:N); only a single API key is disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB