Executive brief
The Jenkins FitNesse Plugin, which integrates the FitNesse testing framework into Jenkins automation, fails to encrypt passwords stored in its configuration files. This allows users with basic read access to the Jenkins system or direct access to the server's files to view sensitive credentials in plain text. This could lead to unauthorized access to external systems or services that use those credentials.
Technical details
The Jenkins FitNesse Plugin (version 1.36 and earlier) suffers from a sensitive data exposure vulnerability. Passwords used within the plugin are stored unencrypted in the 'config.xml' files on the Jenkins controller. An attacker with 'Item/Extended Read' permissions through the Jenkins UI, or an attacker with local filesystem access to the Jenkins controller, can read these files and retrieve the plain-text passwords. This violates the security principle of protecting secrets at rest. As of the advisory date, users are advised to check for updates from the Jenkins project, though a specific patched version was not detailed in the provided snippet for this specific CVE.
Affected products
- Jenkins Project FitNesse Plugin 1.36 and earlier
Timeline
- 2026-06-24: disclosed: Initial disclosure in Jenkins Security Advisory
- 2026-06-24: advisory: NVD publication date