CVE-2026-33003 Details
Description
Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
A vulnerability exists in the LoadNinja Plugin for Jenkins, specifically in versions through 2.1, where LoadNinja API keys are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these API keys. Furthermore, the job configuration form does not mask the API keys, increasing the risk of unauthorized observation and capture.
Users of the LoadNinja Plugin should update to version 2.2, which encrypts the API keys and masks them in the job configuration form.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins loadninja | < 2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |
| Mar 18, 2026 | CVE Modified | CISA-ADP |