CVE-2026-33004 Details
Description
Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
A vulnerability exists in the LoadNinja Plugin for Jenkins, specifically in versions 2.1 and earlier, where LoadNinja API keys are not properly masked in the job configuration form. This oversight increases the risk of unauthorized users observing and capturing these keys. The unmasked API keys are stored in plain text within the job 'config.xml' files on the Jenkins controller, accessible to users with Item/Extended Read permission or those who can access the Jenkins controller file system.
Users are advised to update the LoadNinja Plugin to version 2.2, which encrypts the API keys and masks them in the job configuration form.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins loadninja | < 2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | New CVE Received | [email protected] |