CVE-2026-70431
HIGH
CVSS 8.8
Java
Verified Advisory
Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier exposes Groovy scripting features that do not integrate with the Script Security Plugin, bypassing sandbox controls. Attackers with Item/Create or Item/Configure permission can exploit this to execute arbitrary code in the context of the Jenkins controller JVM.
Affected versions:
- Multijob Plugin 669.v9d96a_d9c71b_0 and earlier
We recommend updating to: Multijob Plugin 677.v7ffc23d6a_4c2.
CVSS ? · our assessment: act_now
Reference: https://seclists.org/oss-sec/2026/q3/438
Details: https://vuln.today/cve/CVE-2026-70431
Verified by vuln.today against published advisories.
Affected versions
- – Multijob Plugin 669.v9d96a_d9c71b_0 and earlier
Fixed in: Multijob Plugin 677.v7ffc23d6a_4c2
More advisories for Java
- CVE-2026-35482 – Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
- CVE-2026-70440 – Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
- CVE-2026-70427 – Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
- CVE-2026-70432 – Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
- CVE-2026-70429 – Unicode username normalization bypass in Jenkins (CVE-2026-70429)
- CVE-2026-70426 – Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
- CVE-2026-67553 – Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)
- CVE-2026-67552 – Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)