CVE-2026-33004 Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Attackers can observe and capture LoadNinja API keys displayed on the job configuration form due to lack of masking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33004?
CVE-2026-33004 is a medium-severity vulnerability in Jenkins LoadNinja Plugin, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Weakness: CWE-200
Which versions are affected by CVE-2026-33004?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:loadninja. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:loadninja Maven | All versions | 2.2 |
org.jenkins-ci.plugins:loadninja Maven | All versions | 2.2 |
Products include Jenkins Loadninja.
How do I fix CVE-2026-33004?
Upgrade org.jenkins-ci.plugins:loadninja to 2.2 or later.
Is CVE-2026-33004 being exploited?
There is no known exploitation of CVE-2026-33004 in the wild and no public exploit code.
Other vulnerabilities in Jenkins LoadNinja Plugin
Sources
Also known as GHSA-p9hg-wrmv-v8cp.