CVE-2026-53442: Jenkins Information Disclosure Flaw

CVE-2026-53442 Overview

CVE-2026-53442 affects Jenkins, the open-source automation server, and concerns the insecure storage of secrets submitted through POST config.xml API requests. Jenkins 2.567 and earlier, and LTS 2.555.2 and earlier, fail to encrypt secrets before persisting them inside job config.xml files on the controller. Users with Item/Extended Read permission, or anyone with read access to the Jenkins controller file system, can retrieve these credentials in plaintext. The flaw is classified as [CWE-311] Missing Encryption of Sensitive Data.

Critical Impact
Secrets submitted via REST API job configuration are stored in plaintext, exposing credentials to users with Item/Extended Read permission or file system access on the Jenkins controller.

Affected Products

Jenkins weekly releases 2.567 and earlier
Jenkins LTS 2.555.2 and earlier
Job configuration config.xml files stored on the Jenkins controller

Discovery Timeline

2026-06-10 - CVE-2026-53442 published to NVD
2026-06-10 - Jenkins Security Advisory SECURITY-3744 released
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53442

Vulnerability Analysis

Jenkins exposes a REST endpoint that accepts job configurations as XML via HTTP POST to config.xml. When a configuration submitted through this endpoint contains secret values, Jenkins is expected to encrypt those values using its built-in secret encryption before writing them to disk. In affected releases, this encryption step is skipped for secrets supplied through the POST config.xml submission path. The result is that the controller stores credentials in cleartext within job configuration files under $JENKINS_HOME/jobs/<job>/config.xml.

The issue is bounded by access control rather than network exploitability. An attacker still needs Item/Extended Read permission to view job configurations through the UI or API, or direct read access to the controller file system to inspect the files. Within environments where extended read permission is granted to a broad set of developers, the cleartext storage effectively widens the audience of credential consumers beyond those intended to hold them.

Root Cause

The root cause is a missing encryption step in the code path that handles POST config.xml submissions. The standard UI-driven configuration flow encrypts secret fields before persistence, but the REST submission path bypasses that transformation. Secrets pass through to the on-disk XML representation unmodified, defeating the protection that Jenkins relies on to prevent credential disclosure through configuration export.

Attack Vector

Exploitation requires an authenticated reader. An actor with Item/Extended Read permission queries the affected job's config.xml and extracts the cleartext secret. Alternatively, a user with shell access to the Jenkins controller reads the same files directly from $JENKINS_HOME. The vulnerability does not yield code execution; its impact is limited to confidentiality of secrets that were submitted through the REST API.

No verified proof-of-concept code is available. Refer to the Jenkins Security Advisory SECURITY-3744 for vendor-supplied technical details.

Detection Methods for CVE-2026-53442

Indicators of Compromise

Plaintext credential strings appearing inside $JENKINS_HOME/jobs/*/config.xml instead of the expected {AQAAAB...} encrypted token format.
Unexpected HTTP POST requests to config.xml endpoints from automation accounts or unfamiliar source addresses in Jenkins access logs.
Access log entries showing users with Item/Extended Read permission reading job configurations they do not own.

Detection Strategies

Scan job config.xml files on the controller for secret-bearing XML elements that are not wrapped in the Jenkins {...} encrypted secret format.
Review the Jenkins audit log for REST API submissions to config.xml endpoints and correlate with subsequent reads by other principals.
Inventory accounts holding Item/Extended Read and verify whether the grant is still warranted.

Monitoring Recommendations

Forward Jenkins access and audit logs to a centralized log platform and alert on bulk reads of config.xml resources.
Monitor file system access to $JENKINS_HOME/jobs/ on the controller host for non-Jenkins processes or interactive sessions.
Track changes to permission assignments that grant Item/Extended Read across folders or the global scope.

How to Mitigate CVE-2026-53442

Immediate Actions Required

Upgrade Jenkins weekly to a release later than 2.567, or Jenkins LTS to a release later than 2.555.2, per the vendor advisory.
Rotate every secret that was previously submitted to a job via POST config.xml on an affected version.
Audit and restrict the Item/Extended Read permission to the minimum set of users required for job inspection.

Patch Information

Jenkins addressed the issue in releases published alongside Jenkins Security Advisory SECURITY-3744. Patched versions encrypt secrets supplied through POST config.xml submissions before writing them to job configuration files, restoring parity with the UI configuration flow.

Workarounds

Avoid submitting secrets through the REST config.xml endpoint on unpatched controllers; configure credentials through the Credentials plugin instead.
Tighten file system permissions on $JENKINS_HOME so that only the Jenkins service account can read job configuration files.
Revoke Item/Extended Read from accounts that do not require visibility into raw job configurations.

bash

# Configuration example: locate config.xml files containing unencrypted secrets
find "$JENKINS_HOME/jobs" -name config.xml -exec \
  grep -L '{AQAAAB' {} \; | xargs -r grep -l -E '<secret>|password>|token>'