AIKIDO-2025-10616

github.com/buildkite/agent/v3 is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere Pre-CVE Published Sep 9, 2025

Low Risk

This Affects:

github.com/buildkite/agent/v3

3.41.0 - 3.103.1

Fixed in 3.104.0

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Information Exposure through the buildkite-agent oidc request-token command due to the lack of automatic redaction for OIDC tokens in build logs. Unlike the secret get command, which automatically masks sensitive values, the OIDC token command outputs the raw, sensitive token in plaintext. An attacker with access to build logs (e.g., through a compromised account or misconfigured log storage) could harvest these exposed tokens, which may then be used to impersonate the build identity and gain unauthorized access to dependent services and resources.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/buildkite/agent/v3 is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in versions 3.41.0 - 3.103.1.