CVE-2026-70429CWE-178

CVE-2026-70429

Medium · published August 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-08-05T22:17Z
Affected products (2)
ProductVersionsFixed in
jenkins/jenkins< 2.568.22.568.2
jenkins/jenkins< 2.5762.576
References (1)
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924 · [email protected]
EPSS history
Timeline
  • 05 AUG 17:40Z
    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create…
    cvelistv5