What is the CVSS score of CVE-2026-33003?

CVE-2026-33003 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jenkins are affected by CVE-2026-33003?

CVE-2026-33003 presents moderate security risk, a cleartext storage vulnerability rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33003?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Jenkins CVE-2026-33003

EUVD-2026-12847 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-03-18 jenkins

GHSA-qqjr-hf5h-jx3q

Jenkins Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12847

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

AnalysisAI

The Jenkins LoadNinja Plugin versions 2.1 and earlier stores LoadNinja API keys in plaintext within job configuration files (config.xml) on the Jenkins controller, allowing unauthorized disclosure of sensitive credentials. Users with Item/Extended Read permission on Jenkins jobs or direct file system access to the controller can extract these API keys, potentially leading to account compromise and unauthorized access to LoadNinja services. This is a straightforward credential exposure vulnerability with no complexity barriers to exploitation once access is gained.

Technical ContextAI

The Jenkins LoadNinja Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_loadninja_plugin:*:*:*:*:*:*:*:*) integrates LoadNinja load-testing services with Jenkins CI/CD pipelines. The vulnerability stems from improper credential handling at the root cause level—storing authentication tokens without encryption in configuration files. This represents a CWE-312 class flaw (Cleartext Storage of Sensitive Information) and CWE-522 class issue (Insufficiently Protected Credentials). Jenkins stores job configurations as XML files on the controller file system; the plugin fails to leverage Jenkins' built-in credential encryption mechanisms (which use the Jenkins master key to encrypt sensitive data). When API keys are stored as plaintext in config.xml, any process or user with read access to the Jenkins controller directory structure can retrieve them without additional authentication or decryption steps.

RemediationAI

Upgrade the Jenkins LoadNinja Plugin to a version newer than 2.1, which implements encrypted storage of API credentials using Jenkins' credential management system. Consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 for the exact patched version number and upgrade procedures. As an interim measure prior to patching, restrict Item/Extended Read permissions on Jenkins jobs containing LoadNinja credentials to only trusted administrators, and audit file system access to the Jenkins controller directory to prevent unauthorized credential extraction. Additionally, rotate any LoadNinja API keys that may have been exposed, and enable Jenkins audit logging to detect suspicious credential access attempts.