Skip to main content

Jenkins CVE-2026-70438

| EUVDEUVD-2026-53532 MEDIUM
Missing Authorization (CWE-862)
2026-08-05 GHSA-4v7r-5cqf-6h4r
Jenkins Authentication Bypass
4.3
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
CVSS changed
Aug 06, 2026 - 16:22 NVD
4.3 (MEDIUM)
Analysis Generated
Aug 05, 2026 - 16:29 vuln.today
CVE Published
Aug 05, 2026 - 14:02 oss-security
MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Jenkins 2.575 and LTS 2.568.1 and earlier, along with a broad set of Jenkins plugins, are affected by a batch of security vulnerabilities disclosed in the 2026-08-05 advisory. CVE-2026-70438 is one of the CVEs issued under this advisory batch; based on sequential numbering (the described CVEs run from 70426 through approximately 70435+), it likely corresponds to one of the eleven plugins listed as carrying unresolved security issues without a fix at time of publication - including AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Specific exploitation conditions for CVE-2026-70438 are not determinable from the available data, as no individual description, CVSS vector, or CWE is mapped to this CVE ID in the provided intelligence. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVE-2026-70438 cannot be independently risk-assessed because its individual CVSS vector, CWE classification, affected component, and exploitation conditions are not present in the available data - the CVE description is the full oss-security advisory post, not a per-CVE breakdown. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Jenkins core to version 2.576 (weekly) or 2.568.2 (LTS) immediately to address the confirmed high-severity core vulnerabilities in this advisory batch, per the official advisory at https://www.jenkins.io/security/advisory/2026-08-05/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jenkins

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-1003030 CRITICAL POC
9.9 Mar 08

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
CVE-2015-8103 CRITICAL POC
9.8 Nov 25

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2016-0792 HIGH POC
8.8 Apr 07

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
CVE-2015-5317 HIGH
7.5 Nov 25

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
CVE-2016-0788 CRITICAL
9.8 Apr 07

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by

CVE-2019-1003029 CRITICAL POC
9.9 Mar 08

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
CVE-2018-1000861 CRITICAL POC
9.8 Dec 10

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
CVE-2019-1003005 HIGH POC
8.8 Feb 06

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
CVE-2019-1003002 HIGH POC
8.8 Jan 22

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
CVE-2019-1003001 HIGH POC
8.8 Jan 22

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-70438 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy