CVE-2026-33003: 
Java vulnerability analysis and mitigation

CVE-2026-33003 is a cleartext storage vulnerability in the Jenkins LoadNinja Plugin that exposes LoadNinja API keys stored unencrypted in job config.xml files on the Jenkins controller. It affects LoadNinja Plugin versions 2.1 and earlier. The vulnerability was disclosed on March 18, 2026, as part of the Jenkins Security Advisory SECURITY-3642, and was reported by Adam Jordan. It carries a CVSS v3.1 base score of 4.3 (Medium) (Jenkins Advisory).

The root cause is classified as CWE-312 (Cleartext Storage of Sensitive Information): the LoadNinja Plugin stores API keys in plaintext within the Jenkins job configuration file (config.xml) rather than using Jenkins' built-in secret encryption mechanisms. Any user with Item/Extended Read permission — a relatively common Jenkins permission — or direct access to the Jenkins controller file system can read these credentials. A related issue (CVE-2026-33004) further compounds the risk by failing to mask the API keys in the job configuration form, making them visible to anyone who can view the job configuration UI (Jenkins Advisory).

Successful exploitation allows a low-privileged authenticated user to obtain LoadNinja API keys, which could be used to access the LoadNinja load testing service, potentially enabling unauthorized test execution, data access, or service abuse. The confidentiality impact is limited to the exposed API keys themselves, with no direct integrity or availability impact on the Jenkins instance. However, compromised API keys could facilitate lateral movement into connected LoadNinja environments or be leveraged in broader credential harvesting campaigns targeting CI/CD infrastructure (Jenkins Advisory).

1. Reconnaissance: Identify a Jenkins instance running LoadNinja Plugin version 2.1 or earlier by checking the plugin manager or job configuration pages.
2. Obtain Item/Extended Read permission: Log in with a Jenkins account that has at minimum Item/Extended Read permission on a job configured with the LoadNinja Plugin, or gain access to the Jenkins controller file system.
3. Access job config.xml: Navigate to the Jenkins controller file system path $JENKINS_HOME/jobs/<job-name>/config.xml, or use the Jenkins API endpoint (e.g., https://<jenkins-host>/job/<job-name>/config.xml) to retrieve the job configuration file.
4. Extract API key: Locate the LoadNinja API key stored in plaintext within the config.xml file — no decryption is required.
5. Abuse the API key: Use the extracted API key to authenticate against the LoadNinja API and perform unauthorized actions such as triggering load tests, accessing test results, or enumerating account data (Jenkins Advisory).

• Logs: Jenkins access logs showing requests to /job/<job-name>/config.xml or the Jenkins API endpoint for job configuration by users with Item/Extended Read permission who do not normally access raw configuration files.
• File System: Unexpected access or reads of $JENKINS_HOME/jobs/<job-name>/config.xml files, particularly from non-administrative accounts or automated scripts.
• Network: Unusual API calls to LoadNinja endpoints originating from IP addresses not associated with known CI/CD infrastructure, potentially indicating use of a stolen API key.

Update the Jenkins LoadNinja Plugin to version 2.2 or later, which stores API keys encrypted and masks them in the job configuration form. After upgrading, existing stored API keys should be rotated in the LoadNinja service to invalidate any keys that may have been exposed. As an interim measure, restrict Item/Extended Read permissions to only trusted users and limit direct file system access to the Jenkins controller (Jenkins Advisory).

The vulnerability was covered alongside higher-severity Jenkins CVEs (CVE-2026-33001 and CVE-2026-33002) in several security news outlets, though CVE-2026-33003 itself received limited individual attention due to its medium severity. Coverage from outlets such as SecurityOnline, GBHackers, CyberPress, and CyberSecurityNews focused primarily on the critical RCE and DNS rebinding issues in the same advisory batch. The Jenkins project credited Adam Jordan for discovering and reporting SECURITY-3642 (Jenkins Advisory).