CVE-2026-33004: Jenkins LoadNinja Plugin API Key Exposure Vulnerability
Summary
CVE-2026-33004: Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form. Affects org.jenkins-ci.plugins:loadninja versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins LoadNinja Plugin is an integration tool that allows users to leverage LoadNinja's performance testing capabilities within Jenkins. It enables continuous testing and monitoring of web applications, providing developers with insights into application performance. However, versions 2.1 and earlier of this plugin have a critical security flaw where LoadNinja API keys are displayed in plaintext on the job configuration form, posing a risk of unauthorized access.
Vulnerability Detail
The vulnerability arises from the LoadNinja Plugin's failure to mask sensitive API keys in the job configuration interface. This oversight allows potential attackers to view and capture these keys, which could lead to unauthorized access to LoadNinja services, compromising the security of applications relying on this integration. The issue is classified under CWE-312, indicating improper handling of sensitive information.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid displaying sensitive API keys by limiting access to the job configuration form or by using environment variables to store API keys securely, rather than entering them directly in the configuration.
Conclusion
The Jenkins LoadNinja Plugin vulnerability (CVE-2026-33004) poses a significant risk by exposing sensitive API keys in plaintext. Users are strongly advised to update to version 2.2 or later to mitigate this risk. Temporary workarounds can be implemented until an update is feasible.
See every vulnerability recorded for org.jenkins-ci.plugins:loadninja →
FAQ
The vulnerability allows unauthorized users to view LoadNinja API keys, which can lead to unauthorized access to LoadNinja services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using environment variables to store API keys securely and limit access to the job configuration form.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of risk.
More information about the Jenkins LoadNinja Plugin can be found on the official Jenkins website or its GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:loadninja.
