Multijob Plugin CVE-2026-70431

Exploitation requires the attacker to hold Item/Create or Item/Configure permission in the Jenkins instance - permissions routinely granted to developers and pipeline owners, not limited to administrators. The Multijob Plugin version 669.v9d96a_d9c71b_0 or earlier must be installed and the plugin's Groovy scripting feature must be accessible within the project type. Unauthenticated exploitation is not possible; the attacker must have a valid Jenkins account with the specified permissions. Exploitation is further limited to Jenkins instances that have the Multijob Plugin installed; instances running only Jenkins core or other plugins are not affected by this CVE. The Jenkins user database (built-in) does not restrict usernames to ASCII, but access still requires authentication and the specific permission grants.

No CVSS vector or EPSS score was supplied for CVE-2026-70431 in the input data, so quantitative risk metrics are unavailable and the following assessment is entirely inferred from the vulnerability description. The required permissions - Item/Create or Item/Configure - are routinely granted to developers and CI/CD pipeline owners in Jenkins deployments; these are not administrative permissions, meaning the exploitable population within an organization is likely large. The impact of arbitrary code execution on the Jenkins controller JVM is critical in practice: Jenkins controllers typically hold credentials (SSH keys, API tokens, cloud credentials), have access to source repositories, and can deploy to production environments. Despite the absence of KEV or POC signals, the real-world risk to any organization running this plugin version with developer-accessible Item/Configure rights is high. The absence of CVSS data, EPSS, and POC confirmation means this cannot be quantitatively compared against other prioritized CVEs without vendor-supplied scoring from the Jenkins advisory at https://www.jenkins.io/security/advisory/2026-08-05/.

A developer-level Jenkins user with Item/Configure permission opens a Multijob project's configuration page, locates the Groovy scripting field exposed by the plugin, and pastes a payload such as a reverse shell or credential-dumping script. Upon saving and triggering a build, the script executes unsandboxed on the Jenkins controller JVM, giving the attacker read access to all credentials stored in Jenkins, the ability to write files to the controller filesystem, and lateral movement capability to all connected agents and downstream deployment targets.