EUVD-2026-53523
GHSA-7fgq-gph8-29q5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector; high complexity due to required Unicode-permissive external security realm and user-creation capability; no prior privileges if realm allows self-registration; full impersonation yields high C and I with no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Case-insensitivity handling inconsistency in Jenkins 2.575 and earlier allows attackers to impersonate existing users or inherit their permissions by registering accounts with Unicode characters that case-insensitively match existing usernames. Jenkins generates canonical user IDs via lowercasing but performs comparisons using Java's String#equalsIgnoreCase, which follows Unicode case-folding semantics - for example, the Turkish dotless 'ı' is treated as equal to 'i' during comparison but produces a different canonical ID when lowercased. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following: (1) Jenkins is configured to use an external security realm - LDAP, Active Directory, or a custom plugin-based provider - rather than the Jenkins native user database (the native database is explicitly immune due to ASCII-only username enforcement); (2) that external security realm permits user or group names containing non-ASCII Unicode characters, specifically those that case-fold differently under `String#equalsIgnoreCase` than under `String#toLowerCase` (e.g., Turkish dotless 'ı', German sharp 's' 'ß', or similar locale-specific characters); (3) the attacker has the ability to create a new user or group in that security realm - via self-registration, delegated admin access, or a compromised account with user-creation rights; (4) a target user or group with a name susceptible to Unicode homoglyph substitution already exists in Jenkins. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector, EPSS score, or KEV listing was provided in the input data, so all metric assessments below are independently derived. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Jenkins 2.576 (weekly) or Jenkins LTS 2.568.2, both of which contain the fix for SECURITY-3924/CVE-2026-70429 as confirmed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-08-05/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Jenkins instances running version 2.575 or earlier and determine whether external security realms (LDAP, Active Directory, SAML, or other non-native authentication) are configured with support for non-ASCII characters in usernames. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today