CVE-2025-58460 | THREATINT

Description

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

PUBLISHED Reserved 2025-09-02 | Published 2025-09-03 | Updated 2025-09-03 | Assigner jenkins

Product status

Default status

unaffected

Any version

affected

References

www.jenkins.io/security/advisory/2025-09-03/ (Jenkins Security Advisory 2025-09-03) vendor-advisory

cve.org (CVE-2025-58460)

nvd.nist.gov (CVE-2025-58460)

Download JSON