CVE-2025-58460

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58460
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58460.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58460
Aliases
Published
2025-09-03T15:15:39.793Z
Modified
2026-07-12T13:01:00.197695Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b92bcd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References

Affected packages

Git / github.com/jenkinsci/opentelemetry-plugin

Affected ranges

Type
GIT
Repo
https://github.com/jenkinsci/opentelemetry-plugin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f5a4ec123769096ad9a4930ede56588b0fee40f3
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:jenkins:opentelemetry:*:*:*:*:*:jenkins:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1543.1545.vf5a_4ec123769"
        }
    ]
}

Affected versions

0.*
0.14-beta
3.*
3.1086.v955c8a_c4d90a_
3.1092.va_2a_c52b_dd182
3.1111.vc2733c03b_db_1
3.1135.vdcdb_17548474
3.1138.v80fc844ed246
3.1205.v862c5d236ecc
3.1209.v1d64463d3d6c
3.1215.vc9db_a_0b_34c2a_
3.1261.v46101e2a_3660
3.1270.v35d71e4855f1
3.1293.vb_c48573e17a_4
3.1298.vb_3b_a_5d878dda_
3.1310.vfe6b_821a_4ed2
3.1314.vb_3104190d2da_
3.1320.v2eededb_d909e
3.1368.vb_f1dcb_e6595c
3.1383.v32c9f94458e3
3.1391.vcb_a_a_b_9779d75
3.1419.v3b_27ca_911066
3.1423.v0d1a_2fcd2429
3.1464.va_85780e90d4c
3.1475.v21037899cf33
3.1480.v23e541c0fcb_4
3.1487.vf27fcf83deb_b_
3.1490.vfd3786616d1d
3.1494.v1d249433404c
3.1495.v64dcff5b_7a_6c
3.1503.v0696f14605b_b_
3.1505.v69c4d7c9ee62
3.1513.va_7b_d9d2324e5
3.1515.v1b_2d6b_526498
3.1520.vd981c197a_43f
3.1523.v0b_3ce640987d
3.1525.v604f3b_1a_e07b_
3.1543.v8446b_92b_cd64
opentelemetry-0.*
opentelemetry-0.1-alpha
opentelemetry-0.10-beta
opentelemetry-0.11-beta
opentelemetry-0.12-beta
opentelemetry-0.13
opentelemetry-0.15
opentelemetry-0.16
opentelemetry-0.17
opentelemetry-0.18
opentelemetry-0.19
opentelemetry-0.2-alpha
opentelemetry-0.20
opentelemetry-0.21
opentelemetry-0.22-beta-1
opentelemetry-0.22-beta-2
opentelemetry-0.22-beta-3
opentelemetry-0.22-beta-4
opentelemetry-0.3-alpha
opentelemetry-0.4-alpha
opentelemetry-0.5-beta
opentelemetry-0.6-beta
opentelemetry-0.7-beta
opentelemetry-0.8-beta
opentelemetry-0.9
opentelemetry-1.*
opentelemetry-1.0.0
opentelemetry-1.1.0-rc1
opentelemetry-1.1.0-rc2
opentelemetry-1.2.0
opentelemetry-1.2.0-rc1
opentelemetry-1.2.0-rc2
opentelemetry-1.2.1
opentelemetry-2.*
opentelemetry-2.0.0
opentelemetry-2.0.0-alpha-1
opentelemetry-2.0.0-beta-1
opentelemetry-2.0.1
opentelemetry-2.1.0
opentelemetry-2.1.0-rc1
opentelemetry-2.1.0-rc2
opentelemetry-2.1.0-rc3
opentelemetry-2.1.0-rc4
opentelemetry-2.1.1
opentelemetry-2.10.0
opentelemetry-2.10.0-beta-1
opentelemetry-2.10.1
opentelemetry-2.11.0
opentelemetry-2.12.0
opentelemetry-2.12.0-rc1
opentelemetry-2.13.0
opentelemetry-2.14.0
opentelemetry-2.15.0
opentelemetry-2.16.0
opentelemetry-2.17.0
opentelemetry-2.17.0-beta1
opentelemetry-2.18.0
opentelemetry-2.18.0-beta1
opentelemetry-2.19.0
opentelemetry-2.2.0
opentelemetry-2.2.1
opentelemetry-2.2.2
opentelemetry-2.3.0
opentelemetry-2.3.0-rc1
opentelemetry-2.4.0
opentelemetry-2.5.0
opentelemetry-2.5.1
opentelemetry-2.6.0
opentelemetry-2.6.0-rc1
opentelemetry-2.7.0
opentelemetry-2.7.1
opentelemetry-2.7.1-rc1
opentelemetry-2.7.1-rc2
opentelemetry-2.8.0
opentelemetry-2.8.0-rc1
opentelemetry-2.8.0-rc2
opentelemetry-2.8.0-rc3
opentelemetry-2.9.0
opentelemetry-2.9.0-rc1
opentelemetry-2.9.1
opentelemetry-2.9.1-beta-1
opentelemetry-2.9.2

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 559.0,
            "function_hash": "57403864058150233184695057404458372470"
        },
        "id": "CVE-2025-58460-11a9afd8",
        "target": {
            "function": "doCheckElasticsearchCredentialsId",
            "file": "src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 335.0,
            "function_hash": "321901893225926223383751514991628205993"
        },
        "id": "CVE-2025-58460-4d748325",
        "target": {
            "function": "testDoCheckCredentialsId",
            "file": "src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3928407074380494869427502740625831058",
                "260845343153964107004207776179089750850",
                "95329256296008476164276334252899467316",
                "129698312469897862054223116521874709114",
                "50503712443994063295016548671242754106",
                "69290506084679194118568229761813975626",
                "165140746066243337853394834379967587262",
                "85278159032882909282821854804115115589",
                "73316180645929408169688532615912900194",
                "63702062911041143271190804091679939253",
                "169642767375962950675891900847688900266",
                "163828962709390196868603809141937855668",
                "264009138108078509504606196358371106846",
                "178422787825852048300134679419365320442",
                "308722444371163641961067151994006145054",
                "322571108379550492355499250954004655077",
                "254954098808447490501846871889005834535",
                "316727272891655045492523449643532099953",
                "297947162042084392613688632103012613334",
                "287308312919086690654019049272151689284",
                "21182180218454716514383683670960245718",
                "67197169742671443238321965684144374130",
                "311465540564492076777834403454132120506",
                "20394091666296705839800720503170643299",
                "177117314727374897137769917420103199409",
                "163302657197249519923759464326879094012",
                "99005905243757947926811587595986791413",
                "129425282639285739937366323478022441930",
                "190190802625832906856237469734512903673",
                "108587633537507210242609878158511307392"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-58460-5852bf86",
        "target": {
            "file": "src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "116673397594338337320575544673194386384",
                "114744203287136316729778827424897504799",
                "238828621556734265407173879935674915435",
                "121367499587480544648073231109526574600",
                "54725041914846825498414139739402579308",
                "167656256494905691991296006866105804016"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-58460-67e126e8",
        "target": {
            "file": "src/test/java/io/jenkins/plugins/opentelemetry/job/log/ElasticStackConfigurationFormTest.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 377.0,
            "function_hash": "67034988496050743796032597698711641083"
        },
        "id": "CVE-2025-58460-73b472eb",
        "target": {
            "function": "doCheckElasticsearchUrl",
            "file": "src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 356.0,
            "function_hash": "30950822655594422846898471911930673953"
        },
        "id": "CVE-2025-58460-abe6333b",
        "target": {
            "function": "doFillElasticsearchCredentialsIdItems",
            "file": "src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 649.0,
            "function_hash": "156299166644516763446031757468212042036"
        },
        "id": "CVE-2025-58460-af1d2881",
        "target": {
            "function": "doValidate",
            "file": "src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 228.0,
            "function_hash": "273951266703587245639977102215594351739"
        },
        "id": "CVE-2025-58460-db810f9c",
        "target": {
            "function": "testDoFillCredentialsIdItems",
            "file": "src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "59518849625793537720994172417251429594",
                "270792452787116276216626229132844823137",
                "157156389148174420454542251767426013280",
                "183994250614707137269917622290605376108",
                "45193297852731827076150195500747211760",
                "100790264408581466758336296003998625616",
                "22658481758284895681804563160134604613",
                "327338318585454018452746610202095619027",
                "51536235944682670710069443609852821485"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-58460-dcf47d66",
        "target": {
            "file": "src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java"
        },
        "source": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58460.json"
vanir_signatures_modified 
"2026-07-12T13:01:00Z"