Unicode username normalization bypass in Jenkins (CVE-2026-70429)

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, handles case-insensitivity inconsistently between user name storage and comparison: canonical IDs are lowercased, but comparisons use `String#equalsIgnoreCase`, which treats certain Unicode characters (e.g., dotless i `ı`) as equivalent to standard ASCII characters that lowercasing does not. An attacker able to create a user or group whose name case-insensitively matches an existing account can impersonate that user or inherit their permissions. Affected versions: - Jenkins 2.575 and earlier - Jenkins LTS 2.568.1 and earlier We recommend updating to: Jenkins 2.576, Jenkins LTS 2.568.2. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70429