4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58460

CVE-2025-58460: Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials

A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58460

CVE-2025-58460:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.jenkins.plugins:opentelemetry	maven	< 3.1543.1545.vf5a	3.1543.1545.vf5a

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl class, which handles the configuration of the OpenTelemetry plugin's connection to an Elasticsearch backend. Several methods exposed via the Jenkins UI for form validation (doCheck..., doFill..., doValidate...) had missing or insufficient permission checks. The vulnerability description states that an attacker with only Overall/Read permission could exploit this. The patch f5a4ec123769096ad9a4930ede56588b0fee40f3 addresses this by introducing a new isAuthorized() method that strictly checks for Jenkins.ADMINISTER permission and adds this check to the beginning of all the vulnerable methods. The most critical function is doValidate, which, when called by an unauthorized user, would cause Jenkins to send credentials to an attacker-controlled URL. The other identified functions (doFillElasticsearchCredentialsIdItems, doCheckElasticsearchCredentialsId, doCheckElasticsearchUrl) supported the exploitation by allowing an attacker to discover and validate credential IDs before using them in the final validation step.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.