EUVD-2026-70134
GHSA-wv4g-ffg7-rqq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any valid Jenkins credential
-
DeliverySend crafted Stapler POST overwriting IdP metadata file
-
ExploitSubstitute attacker-controlled SAML identity provider
-
ExecutionIssue forged SAML assertion for target user
-
PersistAuthenticate to Jenkins as that user
-
ImpactFull administrative compromise
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must possess a valid Jenkins account at any privilege level (PR:L per the CVSS vector) - a developer, read-only, or build-trigger account is sufficient; anonymous access is not enough. The Jenkins instance must have the SAML Plugin installed and active as the authentication method; Jenkins installations using other auth providers are unaffected. The Stapler data binding endpoint for SAML plugin configuration must be reachable over the network from the attacker's position. Exploitation is bounded by the initial credential requirement, meaning purely unauthenticated external attackers are blocked. SSVC marks this as not automatable, suggesting some manual familiarity with the Stapler binding API is needed. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the core risk accurately: network-reachable Jenkins instances are exploitable by any low-privilege account holder with minimal complexity. The primary limiting factor is PR:L - the attacker must possess a valid Jenkins credential before exploitation, which filters out purely external threats. SSVC rates Technical Impact as 'total' (full compromise achievable through identity impersonation) and Automatable as 'no,' indicating the attack requires some manual interaction or knowledge of the Stapler binding surface. Even a mid-sized municipal IT team in gniezno running Jenkins with SAML authentication should treat this as urgent, since the impact ceiling is complete administrative takeover. No EPSS data was provided and no KEV listing exists, but the straightforward post-authentication path and total impact potential justify prompt remediation priority regardless of current exploitation telemetry. |
| Exploit ScenarioDerived | An attacker with a low-privilege Jenkins developer account sends a crafted HTTP POST request via the Stapler data binding endpoint, overwriting the on-disk SAML IdP metadata file with a version pointing to an attacker-controlled SAML identity provider. The attacker's IdP then issues a signed SAML assertion claiming the identity of a Jenkins administrator, which Jenkins accepts as legitimate because it now trusts the attacker's IdP certificate. The attacker logs into Jenkins with full administrative privileges without ever knowing the actual administrator's password. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. No active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis.
RemediationAI
Update the Jenkins SAML Plugin to the fixed version identified in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4065 - the exact patched release version is not specified in available input data and must be confirmed directly from the advisory before upgrading. Updates are applied via the Jenkins Plugin Manager (Manage Jenkins → Plugins → Available updates). As a compensating control while patching, restrict Jenkins access to the minimum set of trusted users and revoke developer or read-only accounts that do not require SAML configuration access. If SAML authentication is not operationally required, temporarily switching to an alternate authentication realm (e.g., local user database) eliminates the attack surface entirely without losing Jenkins functionality. Review Jenkins audit logs for unexpected modifications to SAML configuration as an indicator of prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins relies on the Stapler web framework to bind HTTP request parameters directly to Java object fields. The SAML Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_saml_plugin:*:*:*:*:*:*:*:*) stores a local copy of the SAML Identity Provider metadata XML - a trusted document that defines the legitimate IdP certificate, endpoints, and entity ID. CWE-284 (Improper Access Control) applies because the Stapler binding endpoint controlling this metadata file lacks the necessary access restriction, allowing any authenticated user to submit a write that replaces the file. Once the trusted IdP metadata is substituted with an attacker-controlled version, the attacker's own IdP becomes the arbiter of SAML assertions, enabling them to craft a valid assertion for any identity registered in Jenkins.
Know when Jenkins Saml Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege network account sufficient; no complexity or interaction needed; full CIA impact via arbitrary identity impersonation within the Jenkins system.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
Articles & Coverage 2
Executive ViewAI
The Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) contains an authentication bypass vulnerability allowing any authenticated Jenkins user with low-privilege access to compromise the entire platform. An attacker can replace the SAML identity provider configuration with attacker-controlled metadata, enabling credential forgery to assume any identity-including administrator accounts. No public exploit has been identified at time of analysis, but organizations using Jenkins for CI/CD orchestration face potential loss of build integrity, artifact tampering, and credential theft across integrated systems.
Implement file-level monitoring and alerting on the SAML metadata file for unauthorized modifications; restrict low-privilege user access to Jenkins configuration endpoints via network ACLs or reverse proxy rules; enable audit logging for all SAML Plugin operations and centralize logs to a SIEM; consider disabling the SAML Plugin entirely if SAML authentication is not actively required; enforce multi-factor authentication for all Jenkins administrators as a detective control against credential misuse if metadata is compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB