Jenkins Apica Loadtest Plugin versions 1.10 and earlier store authentication tokens unencrypted in job configuration files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permission or file system access. The plugin also fails to mask tokens in the job configuration form, increasing exposure risk. No fix is currently available for this vulnerability.