What is the CVSS score of EUVD-2026-53532?

EUVD-2026-53532 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Jenkins EUVD-2026-53532

| CVE-2026-70438 MEDIUM

Missing Authorization (CWE-862)

2026-08-05

GHSA-4v7r-5cqf-6h4r

Authentication Bypass Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

4.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:29 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Jenkins 2.575 and LTS 2.568.1 and earlier, along with a broad set of Jenkins plugins, are affected by a batch of security vulnerabilities disclosed in the 2026-08-05 advisory. CVE-2026-70438 is one of the CVEs issued under this advisory batch; based on sequential numbering (the described CVEs run from 70426 through approximately 70435+), it likely corresponds to one of the eleven plugins listed as carrying unresolved security issues without a fix at time of publication - including AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL. No public exploit has been identified for CVE-2026-70438 specifically, and it does not appear in CISA KEV. The broader advisory includes critical issues such as a Remoting deserialization filter bypass enabling controller-side code execution from agent processes, path traversal enabling arbitrary file write, and CSRF or missing permission checks across multiple plugins.

Technical ContextAI

Jenkins is a widely deployed open-source CI/CD automation server using a controller-agent architecture. The Remoting library (agent.jar/remoting.jar) serializes Java objects between controller and agents; the JEP-200 class filter is the primary deserialization guard. The advisory spans multiple CWE classes: deserialization filter bypass (aligned with CWE-502 and CWE-693), symlink exploitation during tar/tar.gz extraction (CWE-59), path traversal in file parameter names (CWE-22), Unicode case-folding inconsistency in identity comparisons (CWE-178 / CWE-706), unrestricted object instantiation (CWE-470), unauthenticated Groovy execution in Multijob Plugin absent Script Security integration (CWE-693), and CSRF or missing permission checks in several plugins (CWE-352 / CWE-862). CVE-2026-70438 specifically is inferred to reside in one of the unresolved plugin CVEs where no CPE string, CWE mapping, or individual description has been provided in the available data. The Jenkins project is itself a CVE Numbering Authority and submits CVE metadata alongside its advisories.

RemediationAI

Upgrade Jenkins core to version 2.576 (weekly) or 2.568.2 (LTS) immediately to address the confirmed high-severity core vulnerabilities in this advisory batch, per the official advisory at https://www.jenkins.io/security/advisory/2026-08-05/. Update patched plugins to their fixed versions: External Workspace Manager to 1.4.2, HCL AppScan to 1.8.4, Multijob to 677.v7ffc23d6a_4c2, SCM-Manager to 1.12.1, and Webhook Secret Credentials Provider to 32.v09c9b_522f0a_8. For plugins with no available fix - which likely includes the specific component affected by CVE-2026-70438 - disable or uninstall the affected plugin until a patched version is released; this eliminates the attack surface with the trade-off of losing that plugin's functionality. Restrict the blast radius of any residual exposure by limiting Agent/Connect, Item/Configure, Item/Build, and Overall/Manage permissions strictly to trusted principals using Jenkins' role-based access controls. Monitor the Jenkins security advisories mailing list at https://groups.google.com/d/forum/jenkinsci-advisories for follow-up releases addressing the unresolved plugin issues.