PT-2026-26075

CVE-2026-33003

Published

2026-03-18

Updated

2026-03-21

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LoadNinja Plugin versions 2.1 and earlier

Description The Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission, or access to the Jenkins controller file system, to view the API keys. The vulnerable files are located on the Jenkins controller.

Recommendations Update to a newer version of the Jenkins LoadNinja Plugin that addresses this issue.

Exploitability

Fix

Impacts

Researchers

Adam Jordan

Vendors

Affected products

Weakness enumeration

CWE-312: Cleartext Storage of Sensitive Information

Related identifiers

CVE-2026-33003