CVE-2026-53442 Details
Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
A vulnerability exists in Jenkins versions through 2.567 and LTS through 2.555.2, where secrets submitted via POST requests to config.xml are not encrypted before being saved in job configuration files. This allows the secrets to be exposed in plaintext to users with Item/Extended Read permission or access to the Jenkins controller file system. The issue arises because Jenkins writes the POST config.xml submissions directly to disk as soon as they are successfully deserialized, without encrypting sensitive information. Subsequent GET config.xml requests then serve this unencrypted data, including any plaintext secrets, from the disk.
Users should update to Jenkins version 2.568 or LTS version 2.555.3, both of which include the necessary fix. Instructions for updating can be found on the Jenkins website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-311 | Missing Encryption of Sensitive Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins jenkins | < 2.555.3 < 2.568 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | Initial Analysis | [email protected] |
| Jun 10, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |