PT-2026-2556 · Cloudbees+1 · Jenkins+1

Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-68925

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2

Description The Jervis library, used for Job DSL plugin scripts and shared Jenkins pipeline libraries, does not validate the algorithm specified in the JWT header, specifically checking for "alg":"RS256". This could potentially allow for unauthorized access or manipulation of Jenkins pipelines.

Recommendations Update Jervis to version 2.2 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-68925

GHSA-5PQ9-5MPR-JJ85

Affected Products

Jenkins

Jervis

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68925.json · Exploit
• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Patch
• https://github.com/samrocketman/jervis/security/advisories/GHSA-5pq9-5mpr-jj85 · Patch
• https://osv.dev/vulnerability/GHSA-5pq9-5mpr-jj85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68925 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68925 · Vendor Advisory
• https://github.com/samrocketman/jervis · Note
• https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249 · Note
• http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a · Note
• https://twitter.com/CVEnew/status/2011181481121759368 · Twitter Post