PT-2026-26076 · Jenkins · Jenkins Loadninja Plugin+1

Adam Jordan + 3 · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-33004

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LoadNinja Plugin versions 2.1 and earlier

Description The Jenkins LoadNinja Plugin does not properly mask LoadNinja API keys as they are displayed on the job configuration form. This could allow attackers to observe and capture these keys.

Recommendations Update to a newer version of the Jenkins LoadNinja Plugin that addresses this issue.

Fix

Information Disclosure

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-312

Related Identifiers

BDU:2026-04248

CVE-2026-33004

GHSA-P9HG-WRMV-V8CP

Affected Products

Jenkins

Jenkins Loadninja Plugin

References · 7

• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9hg-wrmv-v8cp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33004 · Security Note
• https://bdu.fstec.ru/vul/2026-04248 · Security Note
• https://github.com/jenkinsci/loadninja-plugin · Note
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Twitter Post
• https://twitter.com/CVEnew/status/2034365283335606546 · Twitter Post