What is the CVSS score of CVE-2026-33004?

CVE-2026-33004 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jenkins are affected by CVE-2026-33004?

CVE-2026-33004 presents moderate security risk, a information exposure vulnerability rated CVSS 4.3. Sensitive information could be exposed to unauthorized parties.. A patch is available.

How to fix or mitigate CVE-2026-33004?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Jenkins CVE-2026-33004

EUVD-2026-12849 MEDIUM

Information Exposure (CWE-200)

2026-03-18 jenkins

GHSA-p9hg-wrmv-v8cp

Jenkins Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12849

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

AnalysisAI

The Jenkins LoadNinja Plugin version 2.1 and earlier fails to mask LoadNinja API keys displayed on the job configuration form, allowing attackers with access to the Jenkins web interface to observe and capture sensitive credentials. This information disclosure vulnerability affects Jenkins administrators and users with job configuration visibility, enabling credential theft that could lead to unauthorized access to LoadNinja services and associated testing infrastructure. No CVSS score, EPSS data, or active exploitation status (KEV listing) is currently available in public sources.

Technical ContextAI

The LoadNinja Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_loadninja_plugin:*:*:*:*:*:*:*:*) integrates LoadNinja cloud-based load testing services into Jenkins CI/CD pipelines by storing and displaying API credentials on job configuration pages. The vulnerability is rooted in a failure to implement password masking controls—a standard security practice where sensitive input fields are rendered as masked text (using HTML input type='password' or equivalent obfuscation) rather than plaintext. This falls under CWE-200 (Information Exposure) and more specifically relates to insufficient output encoding and field masking controls. The plugin stores LoadNinja API keys without encrypting their display representation, making them readable to any user who can access the job configuration page via the Jenkins web UI.

RemediationAI

Upgrade the Jenkins LoadNinja Plugin to a version greater than 2.1 immediately by accessing Jenkins' Plugin Manager (Manage Jenkins > Plugin Manager) and updating to the patched release published after the 2026-03-18 advisory (see https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3642 for exact version numbers). If immediate patching is not possible, restrict access to job configuration pages to a minimal set of trusted administrators using Jenkins' role-based access control (RBAC) via the Role Strategy Plugin or matrix-based security features, and audit CloudBees credentials vault to identify any LoadNinja API keys that may have been exposed; rotate those keys in the LoadNinja service immediately. Additionally, monitor LoadNinja account activity logs for unauthorized access attempts and enable multi-factor authentication on LoadNinja accounts to reduce post-compromise impact.