AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-70435

MEDIUM · CVSS 4.2 EPSS 0.12%

Source: NVD + CISA KEV + EPSS · Published 2026-08-05 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The SCM-Manager Plugin in Jenkins versions 1.11.1 and earlier lacks a necessary permission check, enabling users with Overall/Read permissions to connect to arbitrary URLs with attacker-specified credentials. This vulnerability can lead to the exposure of sensitive credentials stored within Jenkins, posing a significant risk to the integrity of the CI/CD pipeline. Organizations using affected versions of Jenkins should prioritize remediation to safeguard against potential credential theft and unauthorized access.

CVE
CVE-2026-70435
Severity
MEDIUM
CVSS
4.2
EPSS
0.12%
Jenkins

Original NVD Description

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.