CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissions

CVE-2026-53442 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Jenkins, a widely-used automation server that stores configuration and secrets for CI/CD pipelines, fails to encrypt sensitive credentials when job configurations are uploaded via API. These plaintext secrets remain stored on disk and can be read by users with basic read permissions or anyone with file system access to the Jenkins controller, exposing critical credentials used for deployment and integration with external systems.

Technologies: Jenkins, org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-53442 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53442 being exploited in the wild.
How severe is CVE-2026-53442?
Medium severity, with a CVSS score of 5.3, published 10 June 2026.
Which products and versions are affected?
Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; 2.556–2.567; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.
Is there a fix for CVE-2026-53442?
Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53442 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-53442?
Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later
    # set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle

Technical details

Jenkins stores job configurations in XML files on disk and allows updates via POST config.xml submissions. The vulnerability (CWE-311: Missing Encryption of Sensitive Data) occurs because Jenkins writes submitted config.xml to disk as-is during processing, without first encrypting secret fields. Subsequent GET config.xml responses serve the file directly from disk, exposing plaintext credentials. The attack requires no authentication (network vector) but does require an attacker to either have Item/Extended Read permission on a job or file system access to the Jenkins controller. The vulnerability was fixed in versions 2.568 and LTS 2.555.3, which now deserialize and re-serialize the configuration (causing automatic encryption of secrets) before persisting to disk.

Affected products

  • Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; 2.556–2.567

Identifiers

  • CVE-2026-53442
  • GHSA-m6wv-wh8g-64xc

Timeline

  • 2026-06-10: disclosed: Vulnerability disclosed in Jenkins Security Advisory 2026-06-10
  • 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.