PT-2026-26076 · Jenkins · Jenkins Loadninja Plugin+1

Adam Jordan + 3 · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33004

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LoadNinja Plugin versions 2.1 and earlier

Description The Jenkins LoadNinja Plugin does not properly mask LoadNinja API keys as they are displayed on the job configuration form. This could allow attackers to observe and capture these keys.

Recommendations Update to a newer version of the Jenkins LoadNinja Plugin that addresses this issue.

Correção

Information Disclosure

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-200

CWE-312

Identificadores relacionados

BDU:2026-04248

CVE-2026-33004

GHSA-P9HG-WRMV-V8CP

Produtos afetados

Jenkins

Jenkins Loadninja Plugin

Referências · 7

• https://github.com/jenkinsci/loadninja-plugin · Nota
• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p9hg-wrmv-v8cp · Aviso do Fabricante
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33004 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-04248 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034365283335606546 · Publicação no Twitter