5.3

CVE-2026-53442

EPSS 0.19%
Veröffentlicht 10.06.2026 13:06:02
Zuletzt bearbeitet 12.06.2026 00:59:52
Quelle jenkinsci-cert@googlegroups.co
CVE-Watchlists
Login
Unerledigt
Login

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 2 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Jenkins SwEditionlts Version < 2.555.3

Jenkins ≫ Jenkins SwEdition- Version < 2.568

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.19%	0.087

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-53442

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-53442

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-53442

EUVD