CVE-2025-58460

Maven/io.jenkins.plugins:opentelemetry CVE-2025-58460: medium 4.2

Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials

Action: Upgrade io.jenkins.plugins:opentelemetry to 3.1543.1545.vf5a or later.

Affected

Fixed versions

Sources

• osv: GHSA-f696-867g-2759
• https://nvd.nist.gov/vuln/detail/CVE-2025-58460
• https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3
• https://github.com/jenkinsci/opentelemetry-plugin
• https://github.com/jenkinsci/opentelemetry-plugin/releases/tag/3.1543.1545.vf5a_4ec123769
• https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602
• http://www.openwall.com/lists/oss-security/2025/09/03/4

CVE-2025-58460 · published 2025-09-03T15:30:34Z · modified 2025-11-05T21:06:50.587578Z · JSON