GHSA-p9hg-wrmv-v8cp

Source

https://github.com/advisories/GHSA-p9hg-wrmv-v8cp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9hg-wrmv-v8cp/GHSA-p9hg-wrmv-v8cp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p9hg-wrmv-v8cp

Aliases

CVE-2026-33004

Published

2026-03-18T18:31:16Z

Modified

2026-03-20T14:46:32.476309Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form

Details

Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Database specific

{
    "cwe_ids": [
        "CWE-312"
    ],
    "github_reviewed_at": "2026-03-19T12:47:16Z",
    "nvd_published_at": "2026-03-18T16:16:28Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Maven / org.jenkins-ci.plugins:loadninja

Package

Name: org.jenkins-ci.plugins:loadninja; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/loadninja

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

2.*

2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p9hg-wrmv-v8cp/GHSA-p9hg-wrmv-v8cp.json"