Jenkins FitNesse Plugin CVE-2026-57302

Exploitation requires one of two distinct access paths: (1) a valid Jenkins account with the Extended Read permission for the target job, accessible over the network via the Jenkins web UI or REST API - no additional configuration change is needed once this permission is granted; or (2) direct filesystem access to the Jenkins controller, sufficient to read the jobs/<job-name>/config.xml file path. The FitNesse Plugin must be installed on the Jenkins instance, and at least one job must have FitNesse credentials configured and saved. Exploitation is limited by the prerequisite of authenticated access (PR:L); unauthenticated remote attackers cannot exploit this flaw. The SSVC automatable=no signal reflects that bulk automated credential harvesting is constrained by the need for individual job-level authenticated access. Environments where no jobs store FitNesse credentials are not exposed.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a network-reachable, low-complexity flaw requiring only low privileges (Extended Read), with limited confidentiality impact. SSVC signals reinforce the measured risk posture: exploitation status is none, the attack is not automatable, and technical impact is partial. EPSS at 0.17% (7th percentile) is very low, suggesting this vulnerability has not attracted exploit tooling. No KEV listing confirms there is no observed active exploitation. The primary real-world risk is insider threat or credential harvesting during post-compromise lateral movement - an attacker who already has low-privilege Jenkins access can silently collect FitNesse system passwords. This is a genuine but contained risk: high-severity environments where FitNesse credentials grant access to sensitive systems should treat this as a meaningful finding; low-value FitNesse configurations may warrant lower remediation urgency.

A low-privileged Jenkins user - such as a developer granted Extended Read permission for pipeline visibility - navigates to a FitNesse-enabled job's configuration page or queries the Jenkins API for the job config.xml. The plaintext FitNesse server password appears directly in the response, requiring no decryption or cracking. The attacker then uses the recovered credentials to authenticate directly to the FitNesse server or pivot to other systems that share those credentials. No public exploit code has been identified at time of analysis.