Jenkins VAddy Plugin Plaintext API Auth Key Storage Vulnerability

A vulnerability exists in the VAddy Plugin for Jenkins, specifically in versions through 1.2.8, where Vaddy API authentication keys are stored unencrypted in job configuration files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these keys.

Impact

The unencrypted storage of API authentication keys in job configuration files on the Jenkins controller creates a risk of unauthorized access to VAddy services, potentially leading to misuse of the API or associated resources.