All vulnerabilities
CVE-2026-57302GHSA-j4ph-wp3c-c37w

org.jenkins-ci.plugins:fitnesse: Jenkins FitNesse Plugin stores passwords unencrypted

Jenkins Project org.jenkins-ci.plugins:fitnessemavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

Text from GitHub Advisory Database

Affected versions 26

  • org.jenkins-ci.plugins:fitnesse, maven<= 1.36GitHub
  • Jenkins FitNesse Pluginaffected: 1.36CVE List
  • org.jenkins-ci.plugins:fitnesse, Mavenfrom first release, through 1.36OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.10OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.11OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.12OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.13OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.14OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.15OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.16OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.24OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.26OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.27OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.28OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.30OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.31OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.33OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.34OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.35OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.36OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.5OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.6OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.7OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.8OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.8.1OSV
  • org.jenkins-ci.plugins:fitnesse, Maven1.9OSV

References 3