Jenkins Loadninja Plugin CVE-2026-33003

While CVSS and EPSS scores are not provided in the intelligence data, the real-world risk profile is moderate to high. The attack vector is local or low-privilege remote (via Jenkins UI with Item/Extended Read permission), and complexity is minimal—requiring only file access or UI navigation. The technical impact is confidentiality loss of API credentials, which are high-value secrets. The exploit is highly automatable (a script can simply parse config.xml and extract API key values), and there is no indication of complexity barriers. However, the vulnerability requires pre-existing access to Jenkins (either file system or UI permissions), which somewhat limits widespread exploitation in properly secured environments. Organizations with Jenkins accessible from untrusted networks or with overly permissive access controls face elevated risk. The Jenkins security advisory (https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3642) indicates this was reported through proper disclosure channels, suggesting a mature fix is available.

An attacker with low-privilege access to a Jenkins instance—either as an authenticated Jenkins user with Item/Extended Read permission, or as a local user with file system access to the Jenkins controller—navigates to a job configuration page or directly accesses the config.xml file in the Jenkins job workspace directory. The attacker parses the plaintext XML and extracts the LoadNinja API key, which is stored unencrypted. The attacker then uses this API key to authenticate directly to the LoadNinja service, gaining the ability to launch load tests, access performance data, or escalate privileges within the connected LoadNinja account. No proof-of-concept is required; simple file parsing or UI inspection is sufficient, making this trivial to exploit in permissive environments.