4.2 Medium

CVE-2025-58460 A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with…

Description

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins OpenTelemetry Plugin	Versions not published

Do you use Jenkins OpenTelemetry Plugin?

Track this CVE Watch Jenkins OpenTelemetry Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2025-58460

Timeline

Published September 3, 2025
Last modified November 4, 2025

References

Jenkins Security Advisory 2025-09-03 www.jenkins.io

Track this CVE