What is the CVSS score of EUVD-2026-53523?

EUVD-2026-53523 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by EUVD-2026-53523?

A critical vulnerability in Jenkins 2.575 and earlier allows attackers to register accounts using Unicode characters that impersonate legitimate users and inherit their permissions, effectively…

How to fix or mitigate EUVD-2026-53523?

Within 24 hours: Inventory all Jenkins instances running version 2.575 or earlier and determine whether external security realms (LDAP, Active Directory, SAML, or other non-native authentication) are configured with support for non-ASCII characters in usernames. Within 7 days: Implement compensating controls by restricting external authentication realms to ASCII-only usernames, disabling account self-registration where feasible, and establishing monitoring rules for audit logs to detect suspicious account creation with Unicode characters. Within 30 days: Monitor Jenkins security advisories for patch releases targeting CVE-2026-70429, prepare a testing environment for validation, and schedule production upgrades once a patched version is released.

Jenkins EUVD-2026-53523

| CVE-2026-70429 MEDIUM

Improper Handling of Case Sensitivity (CWE-178)

2026-08-05

GHSA-7fgq-gph8-29q5

Information Disclosure Jenkins

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network vector; high complexity due to required Unicode-permissive external security realm and user-creation capability; no prior privileges if realm allows self-registration; full impersonation yields high C and I with no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Sep 08, 2026 - 20:23 NVD

HIGH MEDIUM

CVSS changed

Sep 08, 2026 - 20:23 NVD

8.1 (HIGH) 6.5 (MEDIUM)

Severity Changed

Aug 06, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Aug 06, 2026 - 16:22 NVD

8.1 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Aug 05, 2026 - 16:19 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Username Impersonation in Jenkins 2.575 - CVE-2026-70429 Aug 06, 2026

AnalysisAI

Case-insensitivity handling inconsistency in Jenkins 2.575 and earlier allows attackers to impersonate existing users or inherit their permissions by registering accounts with Unicode characters that case-insensitively match existing usernames. Jenkins generates canonical user IDs via lowercasing but performs comparisons using Java's String#equalsIgnoreCase, which follows Unicode case-folding semantics - for example, the Turkish dotless 'ı' is treated as equal to 'i' during comparison but produces a different canonical ID when lowercased. Exploitation is constrained to deployments using external security realms that permit non-ASCII characters in usernames; no public exploit has been identified at time of analysis.

Technical ContextAI

The root cause is a semantic mismatch between two Java string operations used for different parts of the same logical identity check. Jenkins normalizes user and group canonical IDs by calling String#toLowerCase, which uses locale-dependent Unicode lowercasing and does not map all Unicode variants to the same codepoint as their ASCII equivalents. However, permission and group membership comparisons use String#equalsIgnoreCase, which applies Unicode case-folding rules that are broader - treating characters like the Turkish dotless 'ı' (U+0131) as case-insensitively equal to 'i' (U+0069). This means a new account with a Unicode-variant username resolves to a distinct canonical ID but is treated as identical to an existing privileged user during authorization checks. The CWE category maps to improper authentication or equivalence class handling (similar to CWE-178 Improper Handling of Case Sensitivity). No CPE strings were supplied in the input data; affected builds are Jenkins core up to 2.575 weekly and 2.568.1 LTS.

RemediationAI

Upgrade to Jenkins 2.576 (weekly) or Jenkins LTS 2.568.2, both of which contain the fix for SECURITY-3924/CVE-2026-70429 as confirmed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-08-05/. If immediate patching is not feasible, administrators should audit their configured security realm to determine whether it permits non-ASCII characters in usernames or group names; if so, enforcing ASCII-only username policies at the identity provider level (e.g., LDAP attribute constraints, Active Directory character validation policies) will eliminate the attack surface. Switching to the Jenkins native user database removes the vulnerability entirely but is a significant architectural change requiring migration of existing credentials and sessions. Restricting user self-registration in the external security realm is an effective interim control if registration is the attacker's entry point. No side-effect-free workaround exists short of patching or identity-provider-level character restriction.