CVE-2026-57302: Jenkins FitNesse Plugin Vulnerability

CVE-2026-57302 Overview

CVE-2026-57302 is a cleartext credential storage vulnerability in the Jenkins FitNesse Plugin version 1.36 and earlier. The plugin writes passwords without encryption into job config.xml files on the Jenkins controller. Any user holding the Extended Read permission, or anyone with read access to the controller file system, can retrieve these credentials. The flaw is tracked under [CWE-256: Plaintext Storage of a Password] and was disclosed in Jenkins Security Advisory SECURITY-3555.

Critical Impact
Authenticated low-privilege Jenkins users can harvest plaintext passwords from FitNesse job configurations and reuse them to pivot into integrated systems.

Affected Products

Jenkins FitNesse Plugin version 1.36
Jenkins FitNesse Plugin versions prior to 1.36
Jenkins controller installations exposing job config.xml files

Discovery Timeline

2026-06-24 - Jenkins publishes Security Advisory SECURITY-3555
2026-06-24 - CVE-2026-57302 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57302

Vulnerability Analysis

The Jenkins FitNesse Plugin persists job configuration data to a config.xml file on the Jenkins controller. Passwords supplied for FitNesse integration are written into this file as plaintext rather than being stored using Jenkins' encrypted Secret type. Two access paths expose these credentials. First, users granted the Extended Read permission can view raw job configuration through the Jenkins UI or REST API. Second, any account with read access to the Jenkins controller file system can open the file directly. The EPSS score is approximately 0.17%, indicating low observed exploitation interest, but the issue still presents a credential-leak risk in multi-tenant Jenkins environments.

Root Cause

The plugin does not call Jenkins' credential encryption APIs when serializing password fields. Instead of using hudson.util.Secret to wrap sensitive values, the plugin stores the raw string supplied by the user. This is a direct instance of [CWE-256], where sensitive authentication material is committed to disk without protection.

Attack Vector

An authenticated user with Extended Read permission requests the config.xml of a FitNesse-enabled job and parses the plaintext password element. A second path is available to operators, backup administrators, or attackers who reach the controller file system through unrelated flaws or stolen credentials. Recovered passwords can then be reused against the FitNesse server or any other system sharing the same credential.

No public proof-of-concept exploit code is available. Refer to the Jenkins Security Advisory SECURITY-3555 for vendor technical details.

Detection Methods for CVE-2026-57302

Indicators of Compromise

Unexpected reads of job config.xml files under $JENKINS_HOME/jobs/*/config.xml by non-administrative accounts.
Jenkins audit log entries showing Extended Read permission use against FitNesse job configurations.
Outbound authentication attempts to FitNesse servers from hosts that do not normally run Jenkins jobs.

Detection Strategies

Grep job config.xml files for FitNesse plugin elements containing unencrypted password strings rather than {...} encrypted secret markers.
Review Jenkins role assignments and identify users granted Extended Read or equivalent permissions on FitNesse jobs.
Correlate Jenkins API access logs for /job/<name>/config.xml requests with user role and source IP.

Monitoring Recommendations

Enable Jenkins audit logging plugins and forward events to a central logging or SIEM platform.
Alert on file system access to $JENKINS_HOME/jobs/ outside of the Jenkins service account.
Monitor for credential reuse failures on the FitNesse target server following Jenkins configuration reads.

How to Mitigate CVE-2026-57302

Immediate Actions Required

Inventory all Jenkins controllers running the FitNesse Plugin and identify versions at or below 1.36.
Revoke Extended Read permission from users who do not require it on FitNesse-enabled jobs.
Rotate any passwords previously stored in FitNesse job configurations, since they must be considered exposed.

Patch Information

At the time of advisory publication, the Jenkins Security Advisory SECURITY-3555 lists no fixed version for the FitNesse Plugin. Track the advisory for updates and apply the fixed release as soon as Jenkins publishes it.

Workarounds

Remove the FitNesse Plugin from controllers that do not actively require it.
Restrict file system access to $JENKINS_HOME so only the Jenkins service account can read job configurations.
Replace static passwords in FitNesse job configurations with Jenkins Credentials Binding references where possible.
Limit Extended Read permission to administrators and audit role-based access control assignments regularly.

bash

# Identify FitNesse jobs storing plaintext passwords
grep -rEl '<fitnesse.*[Pp]assword>[^{]' "$JENKINS_HOME"/jobs/*/config.xml

# Tighten file system permissions on the Jenkins controller
chown -R jenkins:jenkins "$JENKINS_HOME"/jobs
chmod -R o-rwx "$JENKINS_HOME"/jobs