Jenkins Apica Loadtest Plugin versions 1.10 and earlier store authentication tokens unencrypted in job config.xml files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. The job configuration form also does not mask these tokens, increasing the risk of token exposure. No fix is currently available for this vulnerability.