Missing permission check in Jenkins SCM-Manager Plugin (CVE-2026-70435)

Jenkins SCM-Manager Plugin 1.11.1 and earlier does not perform a required permission check in an HTTP endpoint. An attacker with Overall/Read permission can exploit this to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, resulting in the capture of credentials stored in Jenkins. Affected versions: - 1.11.1 and earlier We recommend updating to: 1.12.1. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70435