Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-18 | 1 | Disclosure1 |
| 2026-03-21 | 1 | Patch1 |
🚨🚨🚨 『For archives extracted on the controller, this can result in code execution』 CVE-2026-33001、CVE-2026-33002、CVE-2026-33003、CVE-2026-33004 Jenkins Security Advisory 2026-03-18 https://www.jenkins.io/security/advisory/2026-03-18/
Post summary
Jenkins disclosed four CVEs (2026‑33001‑33004) that allow code execution during archive extraction; the advisory includes patches or remediation guidance.
CVE-2026-33003 Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wit… https://www.cve.org/CVERecord?id=CVE-2026-33003
Post summary
CVE‑2026‑33003 highlights that the Jenkins LoadNinja Plugin (v2.1 and earlier) stores API keys unencrypted in job config.xml files, thereby exposing them to users. No evidence of exploitation, PoC, or mitigation is stated.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jenkins | loadninja | - | jenkins | - |