Jenkins Plugin CVE-2026-70435

Exploitation requires network access to the Jenkins controller and at minimum a low-privileged authenticated account (the exact minimum permission level is not confirmed from the truncated description). The affected plugin must be installed and active on the Jenkins instance. The specific plugin, endpoint, and any non-default configuration requirements cannot be determined from the available truncated data - consult the full advisory to confirm. What limits exploitation: authentication is required (PR:N is not assumed given the missing-permission-check class and absence of a PR:N CVSS vector); the attacker must have network access to Jenkins; and only the specific plugin's endpoint is exposed, not the broader Jenkins controller.

No CVSS vector or score is provided for CVE-2026-70435 in the available data, so quantitative risk cannot be directly stated. Based on the advisory pattern - a missing permission check paired with CSRF - this is structurally similar to CVE-2026-70433 (HCL AppScan Plugin, Overall/Read required, credential ID enumeration), suggesting a Medium severity finding. EPSS data is absent. The vulnerability is not listed in CISA KEV and no POC has been identified. Real-world impact depends heavily on what the unprotected endpoint exposes; credential enumeration or information disclosure are the most common consequences of this vulnerability class in Jenkins plugins. The absence of the full description is a material gap - the specific plugin name, exact endpoint, and impact scope cannot be confirmed from available data. Security teams should consult the full advisory at https://www.jenkins.io/security/advisory/2026-08-05/ to assess whether the affected plugin is deployed in their environment.

An authenticated Jenkins user with minimal permissions (e.g., Overall/Read) sends a direct HTTP request to the unprotected endpoint of the affected plugin, bypassing the authorization check that should gate access. The attacker retrieves sensitive information such as credential IDs or configuration data exposed by that endpoint. No public exploit code is known, and the attack requires network access to the Jenkins controller and at least a low-privilege account.