Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted

MEDIUM 6.5CVE-2023-30531 · GHSA-54cw-rvr3-w6cx · Published 12/04/2023 · updated 17/06/2026

In short

CVE-2023-30531 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:consul-kv-builder, consul kv builder (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:consul-kv-builder Maven	`≤ 2.0.13`	No fix yet
consul kv builder jenkins	`≤ 2.0.13`	No fix yet

Description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.

NVD description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.

References

nvd.nist.gov/vuln/detail/CVE-2023-30531 · ADVISORY
jenkins.io/security/advisory/2023-04-12 · WEB
openwall.com/lists/oss-security/2023/04/13/3 · WEB

More vulnerabilities in org.jenkins-ci.plugins:consul-kv-builder

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2023-30531 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:consul-kv-builder, consul kv builder (jenkins).

Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.0% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:consul-kv-builder

Maven

≤ 2.0.13

No fix yet

consul kv builder

jenkins

≤ 2.0.13

No fix yet

Description

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.

NVD description

Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.