CVE-2026-57302: Jenkins FitNesse Plugin Stores Passwords Unencrypted
Summary
CVE-2026-57302: Jenkins FitNesse Plugin stores passwords unencrypted. Affects org.jenkins-ci.plugins:fitnesse versions < 1.36. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins FitNesse Plugin is a tool that integrates FitNesse, a testing framework, into Jenkins, a widely used automation server. This plugin allows users to create and manage FitNesse tests within Jenkins jobs. However, versions 1.36 and earlier of this plugin have a critical security flaw where sensitive information, specifically passwords, are stored in plaintext within job configuration files. This poses a significant risk as unauthorized users can access these passwords.
Vulnerability Detail
The Jenkins FitNesse Plugin versions up to 1.36 store passwords unencrypted in the job config.xml files on the Jenkins controller. This vulnerability arises from the lack of encryption for sensitive data, making it accessible to any user with Item/Extended Read permission or those who have access to the Jenkins controller's file system. The ramifications include potential unauthorized access to sensitive systems and data, leading to further security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users should limit access to the Jenkins controller and ensure that only trusted individuals have Item/Extended Read permissions.
Conclusion
The Jenkins FitNesse Plugin has a significant vulnerability that exposes unencrypted passwords in job configuration files. While there is no immediate fix, users should be vigilant about access permissions and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for org.jenkins-ci.plugins:fitnesse →
FAQ
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Versions 1.36 and earlier of the Jenkins FitNesse Plugin are affected by this vulnerability.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
It is recommended to review access permissions and limit them to trusted users while monitoring for updates from the Jenkins community for a fix.
Currently, the plugin does not support encryption for stored passwords. Users should await a patch or consider alternative methods for securing sensitive data.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:fitnesse.
