EUVD-2026-70145
GHSA-fhmr-cpfh-453h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable with only a valid Entra account (PR:L); display-name collision requires no special timing or complexity (AC:L); full Jenkins compromise yields C:H/I:H/A:H.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
5DescriptionCVE.org
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.
Articles & Coverage 2
AnalysisAI
Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to hold simultaneously: (1) The target Jenkins instance must have the Microsoft Entra ID Plugin installed and configured to use Entra group membership for authorization - Jenkins instances using LDAP, internal user databases, or other auth strategies are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the Jenkins Microsoft Entra ID Plugin to a version beyond 710.v0b_ff8e9cc2d2 as released by the Jenkins project; consult the Jenkins Security Advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3935 for the exact fixed release version, which was not independently confirmed from the provided input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Jenkins instances using the Microsoft Entra ID Plugin and document the installed versions; simultaneously restrict Entra group-creation permissions to administrators only to prevent exploitation at the tenant level. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today