The LoadNinja Plugin for Jenkins stores API keys in job configuration files without encryption. Anyone who views the config.xml, either directly through the web UI with Item/Extended Read rights or via filesystem access on the Jenkins controller, gains read access to these secrets. This flaw allows the compromise of confidentiality, potentially enabling attackers to misuse the LoadNinja service or access protected resources.

All Jenkins installations running LoadNinja Plugin 2.1 or earlier are affected. The vulnerability is present in the Jenkins Project’s LoadNinja Plugin, as listed by the CNA. Updates or newer plugin versions should be checked for remediation.

The CVSS score of 4.3 indicates moderate severity, while an EPSS below 1% implies low immediate exploitation likelihood. The issue is not listed in the CISA KEV catalog. Exploitation requires either web UI access with Item/Extended Read permission or direct file system access on the control plane, so it is largely limited to insiders or privileged users. Nonetheless, the exposure of API credentials is a significant risk to confidentiality.