GHSA-qqjr-hf5h-jx3q

Source

https://github.com/advisories/GHSA-qqjr-hf5h-jx3q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qqjr-hf5h-jx3q/GHSA-qqjr-hf5h-jx3q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qqjr-hf5h-jx3q

Aliases

CVE-2026-33003

Published

2026-03-18T18:31:16Z

Modified

2026-03-19T13:11:20Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files

Details

Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Database specific

{
    "cwe_ids":  [
        "CWE-312"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-19T12:47:11Z",
    "nvd_published_at":  "2026-03-18T16:16:28Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:loadninja

Package

Name: org.jenkins-ci.plugins:loadninja; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/loadninja

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

2.*

2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qqjr-hf5h-jx3q/GHSA-qqjr-hf5h-jx3q.json"