Unrated

Jenkins FitNesse Plugin stores passwords unencrypted

Type: advisorySource: OSV1 source record

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Announced 24 Jun 2026Group revision 1

Original source ↗

GHSA-j4ph-wp3c-c37w

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-j4ph-wp3c-c37w

org.jenkins-ci.plugins:fitnesse

Source reference: /affected/0/package/name

Affected versions: 1.10
Source reference: /affected/0/versions
1.11
Source reference: /affected/0/versions
1.12
Source reference: /affected/0/versions
1.13
Source reference: /affected/0/versions
1.14
Source reference: /affected/0/versions
1.15
Source reference: /affected/0/versions
1.16
Source reference: /affected/0/versions
1.24
Source reference: /affected/0/versions
1.26
Source reference: /affected/0/versions
1.27
Source reference: /affected/0/versions
1.28
Source reference: /affected/0/versions
1.30
Source reference: /affected/0/versions
1.31
Source reference: /affected/0/versions
1.33
Source reference: /affected/0/versions
1.34
Source reference: /affected/0/versions
1.35
Source reference: /affected/0/versions
1.36
Source reference: /affected/0/versions
1.5
Source reference: /affected/0/versions
1.6
Source reference: /affected/0/versions
1.7
Source reference: /affected/0/versions
1.8
Source reference: /affected/0/versions
1.8.1
Source reference: /affected/0/versions
1.9
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "1.36"
          }
        ]
      }
    ],
    "package": {
      "name": "org.jenkins-ci.plugins:fitnesse",
      "purl": "pkg:maven/org.jenkins-ci.plugins/fitnesse",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.10",
      "1.11",
      "1.12",
      "1.13",
      "1.14",
      "1.15",
      "1.16",
      "1.24",
      "1.26",
      "1.27",
      "1.28",
      "1.30",
      "1.31",
      "1.33",
      "1.34",
      "1.35",
      "1.36",
      "1.5",
      "1.6",
      "1.7",
      "1.8",
      "1.8.1",
      "1.9"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j4ph-wp3c-c37w/GHSA-j4ph-wp3c-c37w.json"
    }
  }
]

Related CVEs: CVE-2026-57302
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event: #17854 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:41:52 GMT
Publisher date: Wed, 24 Jun 2026 15:31:48 GMT

Read the original announcement

Revision history

25 Oct 2026GHSA-j4ph-wp3c-c37w · Revision 1Source updated