Jenkins Curseforge Publisher
CVE-2025-64147
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins with config access
-
ExploitOpen Curseforge Publisher job configuration
-
ExecutionObserve unmasked API Key field
-
ImpactCapture and reuse credential
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encryption of sensitive data
|
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user who can access the Curseforge Publisher Plugin job configuration form, where the CurseForge API Key is displayed without masking; the value is also exposed to anyone who can view that user's screen. Limiting factors: the attacker must already be authenticated with at least job read/configure access (PR:L), the impact is confined to disclosure of the CurseForge API key only (no integrity or availability impact), and this affects version 1.0 of this specific plugin - not Jenkins core. The downstream severity depends on the privileges that the leaked CurseForge API key itself carries. |
| Impact | This is a low-to-moderate severity information-disclosure issue (CWE-311, missing masking of sensitive credentials), not a high-priority emergency. The input CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is consistent with the description: network-reachable via the Jenkins web UI, low complexity, but requiring an authenticated user (PR:L) with access to the job configuration form, and only a limited confidentiality impact (C:L) with no integrity or availability effect. All exploitation signals point the same direction and do not conflict: EPSS is low at 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit code is referenced - no public exploit identified at time of analysis. The realistic risk is a shoulder-surfing / casual-capture exposure of a CurseForge API key to users who can already open the job configuration, rather than a remotely weaponizable flaw. No SSVC decision data was provided in the input. Overall this is a genuine but low-urgency hardening issue, elevated only where the leaked CurseForge API key itself grants meaningful publishing access. |
| Exploit ScenarioDerived | An authenticated Jenkins user (or someone shoulder-surfing/screen-sharing with a user who has job-configuration access) opens the Curseforge Publisher job configuration page, where the API Key is rendered in clear text instead of a masked field, and simply reads or screenshots the credential. No public exploit code is referenced; the 'attack' is passive observation enabled by low complexity (AC:L) but gated by the authenticated access (PR:L) needed to reach the configuration form. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Information disclosure in the Jenkins Curseforge Publisher Plugin 1.0 causes the stored CurseForge API key to be rendered unmasked (in cleartext) on the plugin's job configuration form, so any user who can reach that form can read the credential. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires an authenticated Jenkins user with at least the privileges needed to view the job configuration, and impact is limited to confidentiality - no integrity or availability effect - although downstream risk depends on what the leaked CurseForge API key is authorized to do. There is no public exploit identified at time of analysis, EPSS is low at 0.26% (16th percentile), and the root cause is CWE-311 (missing protection/masking of sensitive data) in version 1.0 of this specific plugin, not in Jenkins core. This is a low-to-moderate severity credential-exposure issue rather than a high-priority emergency, and it also exposes the key to anyone able to observe the configuring user's screen.
RemediationAI
No vendor-released patch version is identified in the available data for the Jenkins Curseforge Publisher Plugin, so the primary action is to check the Jenkins advisory at https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562 (and the OSS-security thread at http://www.openwall.com/lists/oss-security/2025/10/29/2) for the current fixed release and upgrade or remove the plugin accordingly. If no fix is available, compensate by restricting Jenkins authorization so that Job/Configure, Job/Read, and Overall/Read are granted only to trusted users - this removes the low-privileged (PR:L) access path but is disruptive in shared or self-service Jenkins instances; where the plugin supports it, supply the CurseForge API key through Jenkins credentials binding (withCredentials/Secret text) or an environment variable rather than the plain configuration field, accepting that some plugin versions may require scripted configuration. Treat any Jenkins instance running version 1.0 as having a potentially compromised key: rotate the CurseForge API key and scope it to the minimum permissions the publishing job needs, since the real severity depends on what that key can do, and remind configuring users that the value is visible on screen (shoulder-surfing exposure). If the plugin is unused, disabling or uninstalling it is a zero-cost mitigation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Jenkins Curseforge Publisher Plugin, a Jenkins build-pipeline plugin that publishes build artifacts to the CurseForge platform and therefore stores a CurseForge API key in its job configuration. CWE-311 (Missing Encryption of Sensitive Data) is the root-cause class here: the plugin stores and re-renders the API key as an ordinary configuration field instead of using Jenkins' masking primitives (for example hudson.util.Secret, SecretTextarea, or the credentials-binding mechanism), so the Jenkins UI echoes the plaintext value back to anyone who loads the job configuration form. The CPE cpe:2.3:a:jenkins:curseforge_publisher:1.0:*:*:*:*:jenkins:*:* pins the exposure to version 1.0 of this plugin in the Jenkins ecosystem; Jenkins core and other plugins are not implicated. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack is network-reachable and low-complexity but requires a low-privileged authenticated account, needs no user interaction, and stays scope-unchanged with only low confidentiality impact - consistent with an exposure that reveals a single credential rather than enabling direct code execution.
Know when Curseforge Publisher gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Reachable over the Jenkins web UI (AV:N/AC:L) but only by an authenticated user able to view the job config (PR:L); impact limited to disclosing one API key, so C:L, I:N, A:N.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB