CVE-2026-57302: Medium severity Jenkins FitNesse Plugin vulnerability
Published Jun 24, 2026
·Updated
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
Affected Software
2 affected components
Jenkins FitNesse Plugin<=1.36
Jenkins Fitnesse Jenkins<=1.36
Event History
Jun 24, 2026
CVE Published
via MITRE·01:20 PM
Data Sourced
via MITRE·01:20 PM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-57302?
CVE-2026-57302 has a risk score of 37, indicating a significant security vulnerability.
2
How do I fix CVE-2026-57302?
To remediate CVE-2026-57302, update the Jenkins FitNesse Plugin to version 1.37 or later.
3
What impact does CVE-2026-57302 have on my Jenkins installation?
CVE-2026-57302 allows users with Extended Read permission to view unencrypted passwords stored in job config.xml files.
4
Which versions of Jenkins FitNesse Plugin are affected by CVE-2026-57302?
Jenkins FitNesse Plugin versions 1.36 and earlier are affected by CVE-2026-57302.
5
Who is at risk from CVE-2026-57302?
Users with Extended Read permission and/or access to the Jenkins controller file system face a risk from CVE-2026-57302.