Jenkins CVE-2026-53442

Reading the exposed unencrypted secrets requires either (1) Item/Extended Read permission on the affected Jenkins job - a non-default permission that must be explicitly granted in the Jenkins project-level or global authorization matrix - or (2) direct read access to the Jenkins controller filesystem (e.g., via SSH, shared storage, or backup system access). The vulnerability is only triggered for secrets submitted via POST config.xml; jobs that never received secrets via this mechanism are not affected. Note that the CVSS PR:N (no privileges required) conflicts with the description's explicit requirement for Item/Extended Read or filesystem access - the actual privilege floor appears higher than the CVSS vector suggests, and this should be verified with the vendor. Exploitation is limited to the Jenkins controller host; remote controller architectures and agent nodes are not directly affected.

The CVSS 5.3 Medium score is driven by vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network-accessible, low-complexity, unauthenticated information disclosure. However, this PR:N (no privileges required) conflicts with the CVE description, which explicitly states that reading the exposed secrets requires Item/Extended Read permission or direct filesystem access to the Jenkins controller - both imply at least some level of authorization. This discrepancy should be verified against the Jenkins vendor advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744. No EPSS score was provided and no CISA KEV listing exists, indicating no confirmed mass or active exploitation at time of analysis. Real-world risk is highest in environments where Item/Extended Read is broadly granted, or where the Jenkins controller filesystem is accessible to multiple administrators or backup systems. The confidentiality impact is limited per CVSS (C:L), but in practice, a single exposed CI/CD credential can enable significant lateral movement into connected infrastructure.

A Jenkins user with Item/Extended Read permission - or an administrator with SSH access to the Jenkins controller - navigates to or reads a job's config.xml file via the Jenkins REST API (GET /job/<name>/config.xml) or directly from the controller filesystem, and finds plaintext API keys or passwords embedded in the XML that were submitted via a prior POST config.xml operation. No public exploit code is required; standard Jenkins API calls or file read operations are sufficient. The extracted credentials can then be used to authenticate to external services (cloud providers, source control, deployment targets) connected to the compromised CI/CD pipeline.