PT-2026-26075 · Jenkins · Jenkins Loadninja Plugin+1

Adam Jordan · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-33003

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LoadNinja Plugin versions 2.1 and earlier

Description The Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission, or access to the Jenkins controller file system, to view the API keys. The vulnerable files are located on the Jenkins controller.

Recommendations Update to a newer version of the Jenkins LoadNinja Plugin that addresses this issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2026-04247

CVE-2026-33003

GHSA-QQJR-HF5H-JX3Q

Affected Products

Jenkins

Jenkins Loadninja Plugin

References · 7

• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04247 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33003 · Security Note
• https://osv.dev/vulnerability/GHSA-qqjr-hf5h-jx3q · Vendor Advisory
• https://github.com/jenkinsci/loadninja-plugin · Note
• https://twitter.com/CVEnew/status/2034365284283564279 · Twitter Post
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Twitter Post