CVE-2026-33003

# Vulnerability Overview

The Jenkins LoadNinja Plugin versions 2.1 and earlier stores LoadNinja API keys in plaintext within job config.xml files on the Jenkins controller [1]. This failure to encrypt sensitive credentials at rest violates security best practices and allows any user who can read those configuration files to obtain the API keys.

# Attack Surface

Attackers can exploit this vulnerability through two primary vectors. Users with Item/Extended Read permission on a job can view the config.xml via the Jenkins web interface [1]. Additionally, any user with access to the Jenkins controller's file system can read the config.xml files directly [1]. No authentication to the LoadNinja service is required beyond the exposed API key itself.

# Impact

The impact is the unauthorized exposure of LoadNinja API keys, which can be used to access the LoadNinja platform and perform actions such as executing load tests, viewing test results, or managing the account linked to the key [3]. This could lead to resource abuse, data exposure, or further compromise of the LoadNinja service.

# Mitigation

As of the publication date, the vulnerability affects plugin version 2.1 and earlier. Users should monitor the Jenkins project for a patched version that encrypts stored API keys. In the meantime, restricting access to job configurations and the controller file system can reduce risk.