CVE-2019-1003096: Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where...

Security readout for executives and security teams

Jenkins TestFairy Plugin stored credentials in plaintext inside job config.xml files on the Jenkins master. Anyone with Jenkins Extended Read permission, or access to the Jenkins master filesystem, could view those secrets. This is mainly a credential exposure risk, not evidence of remote code execution. Exposure is likely limited to Jenkins instances using the TestFairy Plugin with configured credentials. Risk increases where many users have Extended Read permission, shared administrative access, backups, or broad filesystem access to the Jenkins master. Treat this as a targeted secrets-management issue. It is not documented as actively exploited, but exposed credentials can support service abuse or broader intrusion if Jenkins access is already available. Mitigation focus: Check Jenkins SECURITY-1062 and plugin guidance for current remediation status.; Restrict Jenkins Extended Read permission to trusted administrators only.; Limit filesystem access to the Jenkins master or controller host..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.