PT-2026-48427

CVE-2026-53442

Published

2026-06-10

Updated

2026-08-12

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.568 Jenkins LTS versions prior to 2.555.3

Description Secrets provided via POST config.xml submissions are stored unencrypted in job configuration files on the Jenkins controller. This allows users with Item/Extended Read permissions or direct access to the controller file system to view these secrets.

Recommendations Update to version 2.568 or later. Update to LTS version 2.555.3 or later.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-311: Missing Encryption of Sensitive Data

Related identifiers

CVE-2026-53442

BDU:2026-15346

GHSA-M6WV-WH8G-64XC