CVE-2026-70430CWE-284broken-access-control

CVE-2026-70430

Low · published August 5, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-05T22:17Z
Affected products (2)
ProductVersionsFixed in
jenkins/jenkins< 2.568.22.568.2
jenkins/jenkins< 2.5762.576
References (1)
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3916 · [email protected]
EPSS history
Timeline
  • 05 AUG 17:40Z
    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy…
    cvelistv5