Jenkins Loadninja Plugin CVE-2026-33004

Without a published CVSS vector or EPSS score, risk assessment relies on the vulnerability's inherent characteristics. The attack vector is network-based and requires authentication (Jenkins UI access), which moderates likelihood compared to unauthenticated exploits. However, the technical impact is significant: API keys grant full access to external load testing infrastructure and may enable lateral movement or service abuse. Jenkins environments typically contain multiple administrators and developers with configuration visibility, expanding the exposed audience. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept code has been widely reported, suggesting low active exploitation in the wild. However, the fix is trivial for attackers to leverage once credentials are observed—no exploit complexity is required. This should be categorized as a moderate-to-high priority based on scope (limited to authenticated users), ease of exploitation post-credential-theft, and business impact (loss of testing infrastructure access), rather than a critical network-wide threat.

An attacker with low-level Jenkins user privileges (e.g., a contractor or junior developer with job configuration read access) navigates to an existing job's configuration page and observes the LoadNinja API key displayed in plaintext in the 'API Key' field. The attacker copies the key and uses it to authenticate directly to the LoadNinja API, gaining access to the organization's load testing infrastructure where they can exfiltrate test data, modify test scripts, or launch unauthorized tests against production systems. This requires no exploit code—only the ability to read HTML form values on the Jenkins web interface.