Jenkins Multijob Plugin CVE-2026-70432

Exploitation requires three concurrent conditions: the target Jenkins instance must have Multijob Plugin 669.v9d96a_d9c71b_0 or earlier installed; a user with at least low-privileged Jenkins authentication must have an active session; and that authenticated user must be induced (via phishing, malicious ad, or redirected link) to visit an attacker-controlled web page that fires the forged request. No special plugin configuration beyond standard installation appears necessary. Exploitation is limited by the social engineering dependency - the attacker cannot directly trigger the CSRF without victim interaction - and by network access restrictions: Jenkins controllers behind VPNs or strict firewalls reduce attacker ability to deliver the malicious page or benefit from the forged request. Authentication requirements are confirmed by the CVSS PR:L metric (low-privilege account required).

The NVD-assigned CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals high severity, but the UI:N metric warrants scrutiny: CSRF vulnerabilities inherently require a victim user to trigger the forged request by visiting a malicious page, which most frameworks classify as UI:R. This inconsistency may cause automated scanners to overweight the score. No EPSS data was provided and the vulnerability has no CISA KEV listing, indicating no confirmed widespread exploitation at this time. Real-world risk is elevated in environments where Jenkins controllers are internet-facing or where users access Jenkins via the same browser profile used for general browsing, and lower in air-gapped or VPN-gated deployments. The attacker must also already possess or compromise a low-privileged Jenkins account, which is an additional prerequisite not reflected in the raw score.

An attacker registers a low-privileged Jenkins account or compromises existing credentials, then hosts a malicious web page embedding a hidden CSRF request targeting the vulnerable Multijob Plugin endpoint. A Jenkins user who visits the page while their session is active inadvertently causes the forged request to execute arbitrary code within the Jenkins controller JVM, potentially giving the attacker full control of build pipelines, stored secrets, and connected infrastructure. No public exploit code has been identified at time of analysis, but the CSRF pattern is straightforward to construct given knowledge of the vulnerable plugin endpoint and a captured session.