Jenkins Plugin CVE-2026-70434

Exploitation requires that (1) the vulnerable Jenkins plugin is installed and enabled on the target instance, (2) the attacker can induce an authenticated Jenkins user to visit a malicious web page while the user has an active Jenkins session (UI:R), and (3) the Jenkins instance is reachable from the victim's browser at the time of the request - this is satisfied even for internal Jenkins deployments if the victim is on the same network. No attacker-side authentication is required (PR:N). Exploitation is limited by: requiring victim interaction (no automated exploitation without a logged-in user), the need for the specific plugin to be installed, and the undefined scope of the triggered action (unknown without the full advisory text). The Jenkins user database and standard CSRF crumb protection, when properly configured, would block exploitation; the vulnerability exists precisely because the affected endpoint bypasses crumb validation.

No CVSS vector was provided in the input, so severity metrics are independently assessed below. CSRF vulnerabilities in Jenkins plugins are a recurring class with variable real-world impact depending on what the targeted endpoint does. The co-occurrence of a permission check bypass (CVE-2026-70435) in the same plugin elevates risk: an attacker can chain both flaws - tricking an authenticated user into triggering an unauthorized action the server also fails to gate properly. EPSS data was not provided, and the CVE has no CISA KEV listing and no reported POC. Because the specific plugin and endpoint action are unknown due to the truncated description, impact severity cannot be fully determined from available data. The risk is real but scoped to Jenkins deployments running the affected plugin where users with browser sessions can be socially engineered. Installations behind strong network perimeters or with strict Content-Security-Policy headers reduce but do not eliminate CSRF risk.

An attacker sends a phishing link or embeds a hidden iframe in a page visited by a Jenkins developer who has an active authenticated session. When the victim's browser loads the page, it silently sends a state-changing HTTP request to the vulnerable Jenkins plugin endpoint without a valid CSRF crumb, causing the endpoint to execute its action under the victim's identity and permissions. Because the companion permission check flaw (CVE-2026-70435) also exists, the server does not validate whether the victim's account is actually authorized for that action, potentially allowing the attacker to trigger privileged operations regardless of the victim's role. No public proof-of-concept code has been identified at time of analysis.