HCL AppScan Plugin CVE-2026-70433

Exploitation requires the attacker to hold an active, authenticated Jenkins session with at minimum Overall/Read permission - the baseline permission level in most Jenkins installations. The HCL AppScan Plugin 1.8.3 or earlier must be installed and active on the target Jenkins controller. The affected endpoints are HTTP-accessible, so no special network position beyond reaching the Jenkins web UI is needed. Exploitation is limited to credential ID enumeration only; actual credential secret extraction is NOT possible through this vulnerability alone and requires chaining with a separate flaw. Jenkins installations where all authenticated users are fully trusted administrators present negligible risk; externally accessible or multi-tenant Jenkins instances with untrusted low-privilege users are the primary risk surface.

The standalone CVSS for this issue is moderate: exploitation requires network access and at minimum Overall/Read permission (PR:L), and the direct impact is limited to credential ID disclosure rather than secret exfiltration (C:L/I:N/A:N). However, the real-world risk is elevated in multi-tenant or externally-accessible Jenkins instances where attackers may already hold legitimate low-privilege accounts. The advisory explicitly frames this as a chained attack primitive: credential ID enumeration lowers the effort required to exploit a second vulnerability capable of capturing credential secrets. No CVSS vector was provided by NVD or the vendor advisory at time of analysis; no EPSS score is available; the vulnerability is not listed in CISA KEV; no POC is publicly known. The net assessment is medium priority - patch promptly in environments with untrusted users or external Jenkins access, lower urgency in fully air-gapped or single-tenant deployments where all users are trusted.

An attacker with a low-privilege Jenkins account (holding only Overall/Read) sends unauthenticated-equivalent HTTP requests to the unguarded AppScan Plugin form validation endpoints, receiving a list of credentials IDs stored in Jenkins. The attacker then cross-references those IDs with a separate credential-capture vulnerability (e.g., a CSRF or SSRF flaw in another plugin) to extract the actual secret values, potentially compromising downstream systems integrated with Jenkins. No POC is publicly available at time of analysis.