CVE-2025-53661

The Jenkins Testsigma Test Plan run Plugin versions 1.6 and earlier do not mask Testsigma API keys when displayed on the job configuration form. Instead of replacing the secret with asterisks, the plaintext key is shown, allowing anyone viewing the configuration page to see the credential [1][3].

An attacker with Job/Configure permission on a Jenkins job that uses this plugin can directly view the API key from the form. No additional authentication or network access is required beyond standard Jenkins permissions [1].

Successful exploitation enables an attacker to capture the Testsigma API key, potentially allowing unauthorized access to Testsigma services and actions on behalf of the legitimate user [1][3].

As of the July 2025 security advisory, no patch has been released for this vulnerability. The plugin is listed among those with unresolved security issues, meaning users should consider removing the plugin or manually redacting keys from configuration forms as a workaround [2].