What’s Vulnerable › Vulnerabilities

CVE-2025-47884

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-14 · updated 2026-06-17
• Weakness: CWE-284

Description

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Affected products

• Jenkins Project Jenkins OpenID Connect Provider Plugin: through 96.vee8ed882ec4d

References

• https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574

Get alerted when CVE-2025-47884 or the next vulnerability affects your stack