EUVD-2026-53528
GHSA-h3r9-p4mg-h9jj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable CSRF requires no attacker privileges but needs victim interaction; integrity impact is high given companion permission bypass enables unauthorized actions.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Cross-site request forgery (CSRF) in a Jenkins plugin (SECURITY-3888) allows unauthenticated remote attackers to induce authenticated Jenkins users into triggering unauthorized plugin actions by visiting a malicious page, with no privileges required on the attacker's side. The companion vulnerability CVE-2026-70435 covers a missing permission check in the same plugin, indicating the CSRF-triggered endpoint also lacks server-side authorization enforcement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the vulnerable Jenkins plugin is installed and enabled on the target instance, (2) the attacker can induce an authenticated Jenkins user to visit a malicious web page while the user has an active Jenkins session (UI:R), and (3) the Jenkins instance is reachable from the victim's browser at the time of the request - this is satisfied even for internal Jenkins deployments if the victim is on the same network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided in the input, so severity metrics are independently assessed below. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed plugin version released as part of the 2026-08-05 Jenkins security advisory (https://www.jenkins.io/security/advisory/2026-08-05/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, retrieve the Jenkins security advisory released 2026-08-05 and inventory which Jenkins instances and plugins in your environment are affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today