CVE-2026-53442
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CSIRTS triage
- What
- This advisory addresses multiple vulnerabilities in Jenkins Core.
- Who is affected
- Deployments of Jenkins Core are affected.
- Urgency
- Remediation is necessary, but the severity is currently unknown.
- Action
- Update to the latest version of Jenkins Core.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-53442
Get an email if CVE-2026-53442 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
Advisory coverage (2)
- mediumGHSA-m6wv-wh8g-64xc: Jenkins does not encrypt secrets from POST config.xml submissions before storing them in …ghsa · 2026-06-10
- unknownJenkins Security Advisory 2026-06-10jenkins · 2026-06-10
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-53442)