What is the CVSS score of EUVD-2026-36026?

EUVD-2026-36026 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Jenkins EUVD-2026-36026

| CVE-2026-53442 MEDIUM

Missing Encryption of Sensitive Data (CWE-311)

2026-06-10 jenkins

GHSA-m6wv-wh8g-64xc

Information Disclosure Jenkins Red Hat

5.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:48 vuln.today

CVSS changed

Jun 10, 2026 - 16:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 10, 2026 - 13:06 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

AnalysisAI

Unencrypted secret storage in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier) exposes credentials submitted via POST config.xml to any user holding Item/Extended Read permission or with read access to the Jenkins controller filesystem. Secrets that should be encrypted at rest are written as plaintext into job config.xml files, making them directly readable through Jenkins' built-in permission model or OS-level file access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the privileged insider and lateral-movement risk is significant for organizations embedding CI/CD credentials in job configurations.

Technical ContextAI

Jenkins stores job configurations as XML files (config.xml) on the controller filesystem under the Jenkins home directory. When jobs contain secret fields - such as passwords, API tokens, or injected credentials - these values are normally encrypted before being written to disk using Jenkins' internal secret store. CWE-311 (Missing Encryption of Sensitive Data) describes the root cause: the controller does not apply encryption to secrets submitted via HTTP POST to the config.xml endpoint before persisting them, leaving plaintext credential values in the job's config.xml file. The CPE cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:* covers all Jenkins Project distributions up to the patched releases. Any user or process able to read these files - via the Jenkins API under Item/Extended Read or via direct filesystem access - can extract the plaintext secrets.

RemediationAI

Upgrade to Jenkins 2.568 or later for weekly release users, or Jenkins LTS 2.555.3 or later for LTS users, per the vendor advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744 and ENISA EUVD-2026-36026. These are the vendor-confirmed patched versions. If immediate upgrade is not feasible, restrict Item/Extended Read permissions in the Jenkins authorization matrix to only highly trusted operators, since this permission is the primary read path for job config.xml files - note that tightening this permission may break legitimate read-only access workflows that depend on it. Additionally, audit the Jenkins controller filesystem (typically $JENKINS_HOME/jobs/*/config.xml) for plaintext secrets in existing job configurations, and rotate any credentials found exposed, since files written before patching will remain unencrypted on disk even after upgrading. Limit OS-level read access to the Jenkins home directory to the jenkins service account to reduce filesystem exposure as a compensating control.