{"id":"CVE-2025-58460","details":"A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.","aliases":["GHSA-f696-867g-2759"],"modified":"2026-07-12T13:01:00.197695Z","published":"2025-09-03T15:15:39.793Z","references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/09/03/4"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/opentelemetry-plugin","events":[{"introduced":"0"},{"fixed":"f5a4ec123769096ad9a4930ede56588b0fee40f3"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:opentelemetry:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.1543.1545.vf5a_4ec123769"}],"source":"CPE_RANGE"}}],"versions":["3.1543.v8446b_92b_cd64","3.1525.v604f3b_1a_e07b_","3.1523.v0b_3ce640987d","3.1520.vd981c197a_43f","3.1515.v1b_2d6b_526498","3.1513.va_7b_d9d2324e5","3.1505.v69c4d7c9ee62","3.1503.v0696f14605b_b_","3.1495.v64dcff5b_7a_6c","3.1494.v1d249433404c","3.1490.vfd3786616d1d","3.1487.vf27fcf83deb_b_","3.1480.v23e541c0fcb_4","3.1475.v21037899cf33","3.1464.va_85780e90d4c","3.1423.v0d1a_2fcd2429","3.1419.v3b_27ca_911066","3.1391.vcb_a_a_b_9779d75","3.1383.v32c9f94458e3","3.1368.vb_f1dcb_e6595c","3.1320.v2eededb_d909e","3.1314.vb_3104190d2da_","3.1310.vfe6b_821a_4ed2","3.1298.vb_3b_a_5d878dda_","3.1293.vb_c48573e17a_4","3.1270.v35d71e4855f1","3.1261.v46101e2a_3660","3.1215.vc9db_a_0b_34c2a_","3.1209.v1d64463d3d6c","3.1205.v862c5d236ecc","3.1138.v80fc844ed246","3.1135.vdcdb_17548474","3.1111.vc2733c03b_db_1","3.1092.va_2a_c52b_dd182","3.1086.v955c8a_c4d90a_","opentelemetry-2.19.0","opentelemetry-2.18.0","opentelemetry-2.18.0-beta1","opentelemetry-2.17.0","opentelemetry-2.17.0-beta1","opentelemetry-2.16.0","opentelemetry-2.15.0","opentelemetry-2.14.0","opentelemetry-2.13.0","opentelemetry-2.12.0","opentelemetry-2.12.0-rc1","opentelemetry-2.11.0","opentelemetry-2.10.1","opentelemetry-2.10.0","opentelemetry-2.10.0-beta-1","opentelemetry-2.9.2","opentelemetry-2.9.1","opentelemetry-2.9.1-beta-1","opentelemetry-2.9.0","opentelemetry-2.9.0-rc1","opentelemetry-2.8.0","opentelemetry-2.8.0-rc3","opentelemetry-2.8.0-rc2","opentelemetry-2.8.0-rc1","opentelemetry-2.7.1","opentelemetry-2.7.1-rc2","opentelemetry-2.7.1-rc1","opentelemetry-2.7.0","opentelemetry-2.6.0","opentelemetry-2.6.0-rc1","opentelemetry-2.5.1","opentelemetry-2.5.0","opentelemetry-2.4.0","opentelemetry-2.3.0","opentelemetry-2.3.0-rc1","opentelemetry-2.2.2","opentelemetry-2.2.1","opentelemetry-2.2.0","opentelemetry-2.1.1","opentelemetry-2.1.0","opentelemetry-2.1.0-rc4","opentelemetry-2.1.0-rc3","opentelemetry-2.1.0-rc2","opentelemetry-2.1.0-rc1","opentelemetry-2.0.1","opentelemetry-2.0.0","opentelemetry-2.0.0-beta-1","opentelemetry-2.0.0-alpha-1","opentelemetry-1.2.1","opentelemetry-1.2.0","opentelemetry-1.2.0-rc2","opentelemetry-1.2.0-rc1","opentelemetry-1.1.0-rc2","opentelemetry-1.1.0-rc1","opentelemetry-1.0.0","opentelemetry-0.22-beta-4","opentelemetry-0.22-beta-3","opentelemetry-0.22-beta-2","opentelemetry-0.22-beta-1","opentelemetry-0.21","opentelemetry-0.20","opentelemetry-0.19","opentelemetry-0.18","opentelemetry-0.17","opentelemetry-0.16","opentelemetry-0.15","0.14-beta","opentelemetry-0.13","opentelemetry-0.12-beta","opentelemetry-0.11-beta","opentelemetry-0.10-beta","opentelemetry-0.9","opentelemetry-0.8-beta","opentelemetry-0.7-beta","opentelemetry-0.6-beta","opentelemetry-0.5-beta","opentelemetry-0.4-alpha","opentelemetry-0.3-alpha","opentelemetry-0.2-alpha","opentelemetry-0.1-alpha"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java","function":"doCheckElasticsearchCredentialsId"},"deprecated":false,"digest":{"function_hash":"57403864058150233184695057404458372470","length":559},"id":"CVE-2025-58460-11a9afd8","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3"},{"target":{"file":"src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java","function":"testDoCheckCredentialsId"},"deprecated":false,"digest":{"length":335,"function_hash":"321901893225926223383751514991628205993"},"id":"CVE-2025-58460-4d748325","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3"},{"digest":{"line_hashes":["3928407074380494869427502740625831058","260845343153964107004207776179089750850","95329256296008476164276334252899467316","129698312469897862054223116521874709114","50503712443994063295016548671242754106","69290506084679194118568229761813975626","165140746066243337853394834379967587262","85278159032882909282821854804115115589","73316180645929408169688532615912900194","63702062911041143271190804091679939253","169642767375962950675891900847688900266","163828962709390196868603809141937855668","264009138108078509504606196358371106846","178422787825852048300134679419365320442","308722444371163641961067151994006145054","322571108379550492355499250954004655077","254954098808447490501846871889005834535","316727272891655045492523449643532099953","297947162042084392613688632103012613334","287308312919086690654019049272151689284","21182180218454716514383683670960245718","67197169742671443238321965684144374130","311465540564492076777834403454132120506","20394091666296705839800720503170643299","177117314727374897137769917420103199409","163302657197249519923759464326879094012","99005905243757947926811587595986791413","129425282639285739937366323478022441930","190190802625832906856237469734512903673","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2025-58460-5852bf86","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3","target":{"file":"src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3","target":{"file":"src/test/java/io/jenkins/plugins/opentelemetry/job/log/ElasticStackConfigurationFormTest.java"},"deprecated":false,"digest":{"line_hashes":["116673397594338337320575544673194386384","114744203287136316729778827424897504799","238828621556734265407173879935674915435","121367499587480544648073231109526574600","54725041914846825498414139739402579308","167656256494905691991296006866105804016"],"threshold":0.9},"id":"CVE-2025-58460-67e126e8","signature_type":"Line"},{"digest":{"function_hash":"67034988496050743796032597698711641083","length":377},"id":"CVE-2025-58460-73b472eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3","target":{"file":"src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java","function":"doCheckElasticsearchUrl"},"deprecated":false},{"target":{"file":"src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java","function":"doFillElasticsearchCredentialsIdItems"},"deprecated":false,"digest":{"function_hash":"30950822655594422846898471911930673953","length":356},"id":"CVE-2025-58460-abe6333b","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3"},{"target":{"file":"src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java","function":"doValidate"},"deprecated":false,"digest":{"function_hash":"156299166644516763446031757468212042036","length":649},"id":"CVE-2025-58460-af1d2881","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3"},{"digest":{"function_hash":"273951266703587245639977102215594351739","length":228},"id":"CVE-2025-58460-db810f9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3","target":{"file":"src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java","function":"testDoFillCredentialsIdItems"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3","target":{"file":"src/test/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticsearchBackendITTest.java"},"deprecated":false,"digest":{"line_hashes":["59518849625793537720994172417251429594","270792452787116276216626229132844823137","157156389148174420454542251767426013280","183994250614707137269917622290605376108","45193297852731827076150195500747211760","100790264408581466758336296003998625616","22658481758284895681804563160134604613","327338318585454018452746610202095619027","51536235944682670710069443609852821485"],"threshold":0.9},"id":"CVE-2025-58460-dcf47d66"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58460.json","vanir_signatures_modified":"2026-07-12T13:01:00Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}