CVE-2026-53442
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier do not encrypt secrets from POST config.xml submissions before storing them unencrypted in job configuration files. Secrets are stored in config.xml files in plaintext, allowing users with Item/Extended Read permissions or access to the Jenkins controller file system to view them.
Risk Assessment
The lack of encryption for secrets poses a risk of exposing sensitive information, which could lead to unauthorized access to resources and data within the organization. Users with appropriate permissions can easily read this information.
Recommendation
It is recommended to upgrade to the latest version of Jenkins that implements encryption for secrets in configuration files. Additionally, access to the Jenkins controller file system should be restricted to trusted users.
Original NVD description (English source)
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.