What is the CVSS score of CVE-2026-57302?

CVE-2026-57302 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Jenkins FitNesse Plugin CVE-2026-57302

EUVD-2026-38783 MEDIUM

Plaintext Storage of a Password (CWE-256)

2026-06-24 jenkins

GHSA-j4ph-wp3c-c37w

Jenkins Information Disclosure Jenkins Fitnesse Plugin

4.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network vector applies because Jenkins is web-accessible; PR:L required since Extended Read permission is a prerequisite; confidentiality impact is low, limited to stored FitNesse passwords only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:58 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

AnalysisAI

Plaintext credential storage in Jenkins FitNesse Plugin 1.36 and earlier exposes job-level passwords to any user holding Extended Read permission or with direct access to the Jenkins controller filesystem via job config.xml files. The flaw (CWE-256) means credentials configured within FitNesse jobs are persisted unobfuscated on disk and retrievable through the Jenkins UI without requiring elevated administrative rights. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low opportunistic exploitation activity, though the impact is meaningful in environments where FitNesse jobs store sensitive credentials.

Technical ContextAI

The Jenkins FitNesse Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_fitnesse_plugin:*:*:*:*:*:*:*:*) integrates the FitNesse acceptance-testing framework with Jenkins CI/CD pipelines. Jenkins persists job configurations - including plugin-specific parameters such as remote server credentials - in XML files named config.xml on the Jenkins controller filesystem. CWE-256 (Plaintext Storage of a Password) identifies the root cause: the plugin fails to invoke Jenkins' built-in Secret or hudson.util.Secret encryption APIs when writing credential fields to disk, instead serializing them as readable strings. The Jenkins Extended Read permission is a lower-privilege capability that allows users to view job configurations via the web interface without granting full administrative control, widening the exposure surface beyond just filesystem-level attackers.

RemediationAI

The primary remediation is to upgrade the Jenkins FitNesse Plugin to a version beyond 1.36 that addresses SECURITY-3555; consult the Jenkins advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3555 for the exact patched release, as the fix version is not independently confirmed in the available data. Until a patched version is applied, restrict the Jenkins Extended Read permission to trusted users only, reducing the permission-based exposure vector. Administrators should also audit existing job config.xml files on the Jenkins controller filesystem for plaintext credentials and rotate any exposed passwords after upgrading, since previously stored values will remain unencrypted until job configurations are re-saved with the patched plugin. Tightening filesystem access controls on the Jenkins controller (limiting OS-level read access to the jobs directory) reduces the filesystem access path as a compensating control, though this does not address the web-UI exposure vector.