Sign in

3.5 Low

CVE-2025-67639 A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers…

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins 2.541	earliest → < 2.541	2.541
Jenkins 2.528	earliest → < 2.528.3	2.528.3

The 153 CVEs of Jenkins →

CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium

Do you use Jenkins?

Track this CVE Watch Jenkins Check my SBOMs

www.cveye.io/en/cve/CVE-2025-67639

Timeline

Published December 10, 2025
Last modified December 10, 2025

References

Jenkins Security Advisory 2025-12-10 www.jenkins.io

Track this CVE