Cross-site request forgery in Jenkins SCM-Manager Plugin (CVE-2026-70434)

A cross-site request forgery (CSRF) vulnerability in the Jenkins SCM-Manager Plugin allows attackers to trigger connections to an attacker-specified URL using credentials IDs obtained through a separate method. Successful exploitation results in the capture of credentials stored in Jenkins. Affected versions: - SCM-Manager Plugin 1.11.1 and earlier We recommend updating to: SCM-Manager Plugin 1.12.1. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70434