GitHub Advisoryadvisory · Maven

GHSA-qqjr-hf5h-jx3q Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

MEDIUM Published 2026-03-18 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-33003
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:loadninja
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2026-03-19

Affected packages

• Maven org.jenkins-ci.plugins:loadninja: < 2.2 → fixed in 2.2

Description

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2026-33003 Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References