Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Jenkins Applitools Eyes Plugin stores Applitools API keys insecurely

CVE-2025-53742 · published 1 year ago
Summary

The Jenkins Applitools Eyes Plugin stores sensitive Applitools API keys in plain text on your Jenkins server. This means that anyone with access to the server or specific permissions can see these keys, compromising their security. To protect your API keys, update the plugin to the latest version.

What to do
  • Update jenkins applitools_eyes to version 1.16.6 or later.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:applitools-eyes <= 1.16.5
– jenkins applitools_eyes < 1.16.6
cpe:2.3:a:jenkins:applitools_eyes:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read...
Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published9 Jul 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-q92v-3f4w-5xg8 · GHSA
CVE-2025-53742 · NVD
Track software like this
Free during beta