CVE-2026-70446

The Jenkins CodeSonar Plugin versions 3.6.0 and earlier are vulnerable due to missing permission checks, enabling users with Overall/Read permissions to enumerate stored credential IDs. This exposure could lead to unauthorized access to sensitive credentials, potentially compromising the security of Jenkins environments. Organizations using affected versions of the plugin should prioritize remediation to mitigate the risk of credential enumeration and subsequent attacks.