5.5 Medium

CVE-2025-31726 Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the…

Description

Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Stack Hammer Plugin 1.0	earliest → 1.0.6	No fix stated

Do you use Jenkins Stack Hammer Plugin?

Track this CVE Watch Jenkins Stack Hammer Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2025-31726

Timeline

Published April 2, 2025
Last modified April 3, 2025

References

Jenkins Security Advisory 2025-04-02 www.jenkins.io

Track this CVE