CVE-2026-33003: Jenkins LoadNinja Plugin API Key Exposure in Job Configurations
Summary
CVE-2026-33003: Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files. Affects org.jenkins-ci.plugins:loadninja versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins LoadNinja Plugin is an integration tool that allows users to leverage LoadNinja's capabilities within Jenkins for performance testing. It enables automated load testing and provides insights into application performance. However, versions 2.1 and earlier of this plugin have a significant security flaw that exposes sensitive API keys in an unencrypted format.
Vulnerability Detail
The Jenkins LoadNinja Plugin versions 2.1 and earlier store LoadNinja API keys unencrypted in the job config.xml files on the Jenkins controller. This vulnerability arises from improper handling of sensitive information, allowing users with Item/Extended Read permission or access to the Jenkins controller file system to view these keys. The ramifications include unauthorized access to LoadNinja services, potentially leading to data breaches or misuse of the API.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Jenkins controller file system and limit permissions for users who can view job configurations until the plugin is updated.
Conclusion
The Jenkins LoadNinja Plugin has a vulnerability that exposes API keys in an unencrypted format, which can lead to unauthorized access. It is crucial to update to version 2.2 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for org.jenkins-ci.plugins:loadninja →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Failure to fix this vulnerability may lead to unauthorized access to LoadNinja services, resulting in potential data breaches or misuse of sensitive information.
Yes, you can restrict access to the Jenkins controller file system and limit permissions for users who can view job configurations as a temporary measure.
You can find more information about the Jenkins LoadNinja Plugin on the official Jenkins website or its GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:loadninja.
