CVE-2026-53442: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Limit and audit who has the Item/Extended Read permission in Jenkins; remove the permission from any accounts that do not require it.
Jenkins Item/Extended Read permission = restrict to trusted users - Compensating control
Restrict OS-level and filesystem access to the Jenkins controller to trusted administrators only (apply least-privilege filesystem ACLs, restrict SSH/remote access, and isolate the controller).
- Operational
Search job config.xml files on the Jenkins controller for any secrets stored in plaintext and remove or replace them where possible.
- Operational
Rotate any credentials, API tokens, or secrets that may have been exposed via job config.xml files or by users with Item/Extended Read access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53442?
The severity of CVE-2026-53442 is medium with a score of 5.3.
How do I fix CVE-2026-53442?
To fix CVE-2026-53442, upgrade to Jenkins 2.568 or later, or LTS 2.555.3 or later.
What impact does CVE-2026-53442 have on Jenkins configurations?
CVE-2026-53442 allows secrets from POST config.xml submissions to be stored unencrypted in job configurations, potentially exposing sensitive data.
Who is affected by CVE-2026-53442?
Users with Item/Extended Read permission or access to the Jenkins controller can view unencrypted secrets due to CVE-2026-53442.
Is there a workaround for CVE-2026-53442?
There is no official workaround for CVE-2026-53442; the only remediation is to upgrade to a patched version of Jenkins.