CVE-2026-33004
Received Received - Intake
API Key Exposure in Jenkins LoadNinja Plugin Configuration Form

Publication date: 2026-03-18

Last updated on: 2026-03-21

Assigner: Jenkins Project

Description
Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-03-21
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33004
EUVD
EUVD-2026-12849
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jenkins loadninja to 2.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in the Jenkins LoadNinja Plugin version 2.1 and earlier, where the LoadNinja API keys are not masked on the job configuration form.

Because the API keys are displayed in plain text, attackers who have access to the job configuration form can observe and capture these keys.

Impact Analysis

This vulnerability can lead to unauthorized access if an attacker obtains the LoadNinja API keys.

With these keys, attackers could potentially misuse the LoadNinja services or gain further access to systems integrated with these credentials.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart