# CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissions

Source: https://junglewise.ai/threats/cve-2026-53442-jenkins-plaintext-secret-storage-in-job-config-xml-submissions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-53442 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Jenkins, a widely-used automation server that stores configuration and secrets for CI/CD pipelines, fails to encrypt sensitive credentials when job configurations are uploaded via API. These plaintext secrets remain stored on disk and can be read by users with basic read permissions or anyone with file system access to the Jenkins controller, exposing critical credentials used for deployment and integration with external systems.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-53442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53442 being exploited in the wild.

**How severe is CVE-2026-53442?** Medium severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; 2.556–2.567; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.

**Is there a fix for CVE-2026-53442?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53442 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-53442?** Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle
  ```


## Technical details

Jenkins stores job configurations in XML files on disk and allows updates via POST config.xml submissions. The vulnerability (CWE-311: Missing Encryption of Sensitive Data) occurs because Jenkins writes submitted config.xml to disk as-is during processing, without first encrypting secret fields. Subsequent GET config.xml responses serve the file directly from disk, exposing plaintext credentials. The attack requires no authentication (network vector) but does require an attacker to either have Item/Extended Read permission on a job or file system access to the Jenkins controller. The vulnerability was fixed in versions 2.568 and LTS 2.555.3, which now deserialize and re-serialize the configuration (causing automatic encryption of secrets) before persisting to disk.

## Affected products

- Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; 2.556–2.567

## Identifiers

- CVE-2026-53442
- GHSA-m6wv-wh8g-64xc

## Timeline

- 2026-06-10: disclosed: Vulnerability disclosed in Jenkins Security Advisory 2026-06-10
- 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released with fix

## References

- [https://www.jenkins.io/security/advisory/2026-06-10/](https://www.jenkins.io/security/advisory/2026-06-10/)
- [https://github.com/jenkinsci/jenkins/commit/037c2c30cd26b926ec9df3d1b60e16b80608edb4](https://github.com/jenkinsci/jenkins/commit/037c2c30cd26b926ec9df3d1b60e16b80608edb4)
- [https://github.com/jenkinsci/jenkins/commit/206f0b565f0ce16b5162160ffb96f5dd59002ff7](https://github.com/jenkinsci/jenkins/commit/206f0b565f0ce16b5162160ffb96f5dd59002ff7)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)