Jenkins VAddy Plugin Plaintext API Auth Key Exposure Vulnerability

A vulnerability exists in the Jenkins VAddy Plugin in versions through 1.2.8, where Vaddy API Auth Keys are stored unencrypted in job configuration files on the Jenkins controller. This lack of encryption allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these keys. Additionally, the job configuration form does not mask the API keys, creating an opportunity for attackers to observe and capture them.

Impact

Exposing Vaddy API Auth Keys in plaintext increases the risk of unauthorized access to Vaddy services or resources, potentially leading to further exploitation or misuse.