CVE-2026-33004 impacts Jenkins LoadNinja Plugin versions 2.1 and earlier, where LoadNinja API keys are not masked and are openly displayed on the job configuration form, allowing authenticated users with access to job configurations to observe and capture these sensitive keys. This vulnerability carries a CVSS v3.1 score of 4.3 (Medium), indicating a low confidentiality impact from a network-based attack with low complexity and requiring low privileges. There is currently no evidence of active exploitation, no public exploit code available in Metasploit or ExploitDB, and it has received no community discussion or media coverage, suggesting a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.2CPE matchmatch criteria | cpe:2.3:a:jenkins:loadninja:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.