What is CVE-2025-31726?

CVE-2025-31726 is a medium-severity vulnerability in Jenkins Stack Hammer, classified under Improper Access Control. CVSS score: 5.5/10. Published 2025-04-02.

How severe is CVE-2025-31726?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Jenkins Stack Hammer

CVE-2025-31726

Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

EPSS: 0.003 (19.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L.

Affected products

Jenkins Stack_hammer
Jenkins Project Stack Hammer Plugin — versions 0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2025-31726?: CVE-2025-31726 is a medium-severity vulnerability in Jenkins Stack Hammer, classified under Improper Access Control. CVSS score: 5.5/10. Published 2025-04-02.
How severe is CVE-2025-31726?: Medium severity. CVSS v3 base score is 5.5 out of 10.