Volerion logoVolerion
Volerion logoVolerion

Jenkins Curseforge Publisher Plugin API Keys Exposure Vulnerability

Vulnerability

A vulnerability exists in the Jenkins Curseforge Publisher Plugin version 1.0, where API keys are stored in plain text within job configuration files on the Jenkins controller. This unencrypted storage allows users with Item/Extended Read permission or access to the Jenkins controller file system to view the keys. Additionally, the job configuration form does not mask these API keys, increasing the risk of interception by attackers.

Impact

The vulnerability allows for unauthorized observation and capture of API keys, which could be misused if exploited.

Added: Oct 29, 2025, 2:20 PM
Updated: Oct 29, 2025, 3:26 PM

Vulnerability Rating

Custom Algorithm
spread
6.2
impact
2.5
exploitability
5.2
remediation
0.0
relevance
0.9
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.