PT-2026-26075 · Jenkins · Jenkins Loadninja Plugin+1

Adam Jordan · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33003

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LoadNinja Plugin versions 2.1 and earlier

Description The Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission, or access to the Jenkins controller file system, to view the API keys. The vulnerable files are located on the Jenkins controller.

Recommendations Update to a newer version of the Jenkins LoadNinja Plugin that addresses this issue.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

BDU:2026-04247

CVE-2026-33003

GHSA-QQJR-HF5H-JX3Q

Produtos afetados

Jenkins

Jenkins Loadninja Plugin

Referências · 7

• https://github.com/jenkinsci/loadninja-plugin · Nota
• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-04247 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034365284283564279 · Publicação no Twitter
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33003 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qqjr-hf5h-jx3q · Aviso do Fabricante