CVEvulnerability

CVE-2026-70430

2.7 LOW Published 2026-08-05 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-08-05
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-284

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

Affected configurations

• jenkins jenkins (< 2.568.2) • jenkins jenkins (< 2.576)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References