The Jenkins project has issued a critical security notice addressing vulnerabilities within five essential plugins: Cadence vManager, DingTalk, Health Advisor by CloudBees, OpenID Connect Provider, and WSO2 Oauth.
These vulnerabilities, with severity levels ranging from medium to critical, could enable attackers to bypass authentication mechanisms, execute harmful code, or access sensitive data. Jenkins administrators are strongly urged to take immediate action to safeguard their CI/CD environments.
Critical Vulnerabilities Identified
Two vulnerabilities have been flagged as critical, with CVSS scores of 9.1 and 9.8, presenting significant threats to Jenkins ecosystems:
- OpenID Connect Provider Plugin (CVE-2025-47884, CVSS: 9.1): A flaw in versions 96.v8ed882ec4d and earlier allows attackers to manipulate build ID tokens by overriding environment variables, such as those used by plugins like Environment Injector. This enables impersonation of trusted jobs, potentially allowing attackers to access external services. The issue is resolved in version 111.v29fd614b_3617, which prevents the overriding of environment variables.
- WSO2 Oauth Plugin (CVE-2025-47889, CVSS: 9.8): Versions 1.0 and earlier fail to validate authentication claims, enabling unauthenticated attackers to login with any username and password. Though sessions lack group privileges, systems with lenient authorization strategies, such as “Logged-in users can do anything,” are at risk of full administrative access. No fix is available yet, leaving systems vulnerable.
Additional High and Medium Severity Issues
Other vulnerabilities identified include:
- Health Advisor by CloudBees Plugin (CVE-2025-47885, CVSS: High): Versions 374.v194b_d4f0c8c8 and earlier are vulnerable to stored cross-site scripting (XSS) due to unescaped server responses. Attackers who control the Jenkins Health Advisor server could inject malicious scripts. This is resolved in version 374.376.v3a_41a_a_142efe, which escapes server responses.
- Cadence vManager Plugin (CVE-2025-47886, CVE-2025-47887, CVSS: Medium): Versions 4.0.1-286.v9e25a_740b_a_48 and earlier lack proper permission checks, making them susceptible to cross-site request forgery (CSRF). Attackers with Overall/Read permission could exploit the vulnerability to connect to malicious URLs using arbitrary credentials. Version 4.0.1-288.v8804b_ea_a_cb_7f addresses this by enforcing stricter permissions for POST requests.
- DingTalk Plugin (CVE-2025-47888, CVSS: Medium): Versions 2.7.3 and earlier have a serious flaw that disables SSL/TLS certificate and hostname validation for webhook connections, increasing the risk of man-in-the-middle attacks. No fix is available, leaving users exposed.
Affected Versions and Fixes
The specific versions of these plugins affected by the vulnerabilities are outlined below:
| Plugin Name | Current Version | Available Update |
|---|---|---|
| Cadence vManager Plugin | Up to 4.0.1-286.v9e25a_740b_a_48 | 4.0.1-288.v8804b_ea_a_cb_7f |
| DingTalk Plugin | Up to 2.7.3 | No fix available |
| Health Advisor by CloudBees Plugin | Up to 374.v194b_d4f0c8c8 | 374.376.v3a_41a_a_142efe |
| OpenID Connect Provider Plugin | Up to 96.vee8ed882ec4d | 111.v29fd614b_3617 |
| WSO2 Oauth Plugin | Up to 1.0 | No fix available |
Administrators are strongly advised to immediately upgrade to the latest patched versions of affected plugins. However, for DingTalk and WSO2 Oauth plugins, no fixes have been released by the Jenkins project, due to their lack of maintenance or other limitations. In such cases, administrators should consider either disabling these plugins or implementing mitigating controls, such as enforcing stricter network security or limiting access.
These vulnerabilities highlight the inherent risks associated with using outdated or improperly configured plugins within Jenkins, a critical element of DevOps workflows.
The issue with WSO2 Oauth underscores the significant dangers of weak authentication practices in secure environments, while the OpenID Connect flaw emphasizes the risks of environment variable manipulation in complex CI/CD configurations.
This advisory also serves as a reminder of the larger issue of software supply chain security, where widely-used tools like Jenkins remain prime targets. Cyber attackers may exploit these vulnerabilities to inject malicious code, escalate privileges, or disrupt build processes, potentially affecting downstream software integrity.
To mitigate risks, Jenkins administrators should:
- Update Affected Plugins: Apply patches for the Cadence vManager, Health Advisor by CloudBees, and OpenID Connect Provider plugins.
- Disable Unfixed Plugins: Consider removing or isolating DingTalk and WSO2 Oauth plugins until fixes are available.
- Strengthen Security Controls: Implement least-privilege access, enable signed commits, and closely monitor CI/CD logs for unusual activities.
- Audit Commit History: Utilize external logging systems and immutable mirrors to detect any manipulation of timestamps, as part of defending against commit stomping.
- Stay Vigilant: Keep an eye on Jenkins security advisories and plugin updates to ensure ongoing protection.
