EUVD-2026-70134
GHSA-wv4g-ffg7-rqq4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege network account sufficient; no complexity or interaction needed; full CIA impact via arbitrary identity impersonation within the Jenkins system.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
Articles & Coverage 2
AnalysisAI
Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid Jenkins account at any privilege level (PR:L per the CVSS vector) - a developer, read-only, or build-trigger account is sufficient; anonymous access is not enough. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the core risk accurately: network-reachable Jenkins instances are exploitable by any low-privilege account holder with minimal complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Jenkins SAML Plugin to the fixed version identified in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4065 - the exact patched release version is not specified in available input data and must be confirmed directly from the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Jenkins instances using the SAML Plugin and document SAML authentication dependencies; immediately restrict administrative access to plugin configuration files and SAML metadata on affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today