Jenkins CVE-2025-67636

Exploitation requires an authenticated Jenkins user who already holds the View/Read permission on an affected instance (Jenkins 2.540 or earlier, or LTS 2.528.2 or earlier) and requires that a view containing password values exists to be displayed. Key limiting factors: the attacker must be a provisioned, authenticated account (PR:L), no privilege escalation beyond that is possible, and the values returned are encrypted rather than plaintext - so direct secret recovery depends on separately defeating Jenkins' encryption or reusing the encrypted form. No user interaction by a victim is needed.

This is a low-to-moderate priority information-disclosure issue, not a high-urgency flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) signals network reach and low complexity, but PR:L means the attacker must already be an authenticated Jenkins user holding View/Read permission, and impact is confined to confidentiality only (C:L, no integrity/availability). The description further notes that only the ENCRYPTED password values are exposed, not decrypted plaintext, which caps the practical damage unless an attacker can separately break or reuse those encrypted blobs. All exploitation signals point the same direction and are consistent: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit is identified - a low-likelihood, low-impact profile with no conflicting indicators. One data caveat: the input Tags label this 'Authentication Bypass,' which conflicts with CWE-862 (Missing Authorization) and the description's own framing of a missing PERMISSION check against an already-authenticated user - this is an authorization/permission-check defect, not an authentication bypass.

A low-privileged Jenkins user who only holds View/Read permission opens a configured view and reads encrypted password values that should have been hidden from them due to insufficient permissions. No public exploit code is required or known; the data is exposed through normal UI access once the user is authenticated to the affected instance.