Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
Date: 2026-03
Affected: maven/org.jenkins-ci.plugins:loadninja
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33001
CVE-2026-33003
CWE: CWE-312
CWE-59
CWE-61
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.


Mitigations:

Architectural layers (MAESTRO):