CVE-2026-53442

{
  "id": "CVE-2026-53442",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-10T14:16:37.180",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system."
    },
    {
      "lang": "es",
      "value": "Jenkins 2.567 y anteriores, LTS 2.555.2 y anteriores no cifra los secretos de los envíos POST de config.xml antes de almacenarlos en las configuraciones de trabajo sin cifrar en los archivos config.xml de trabajo en el controlador de Jenkins, donde pueden ser vistos por usuarios con permiso de Lectura de Elemento/Extendida, o acceso al sistema de archivos del controlador de Jenkins."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Jenkins Project",
          "product": "Jenkins",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "2.568",
              "lessThan": "*",
              "versionType": "maven",
              "status": "unaffected"
            },
            {
              "version": "2.555.3",
              "lessThan": "2.555.*",
              "versionType": "maven",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-10T14:36:40.377131Z",
          "id": "CVE-2026-53442",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
              "versionEndExcluding": "2.555.3",
              "matchCriteriaId": "648B5148-FE3B-464A-8963-DCF7ACEF84E5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
              "versionEndExcluding": "2.568",
              "matchCriteriaId": "356A970F-6576-49B6-8EBA-E9770ED190A7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}