CVE-2026-57302

MEDIUM CVSS 4.3 View on NVD ↗

Description

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3555

Published: Jun 24, 2026 14:17 UTC Modified: Jun 24, 2026 16:16 UTC