CVE-2026-70430
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. Attackers with Overall/Manage permission can instantiate arbitrary types related to configuration, including those intended only for administrators.
Risk Assessment
The ability to instantiate arbitrary configuration types may lead to privilege escalation or unauthorized modification of Jenkins configuration, threatening system integrity and security.
Recommendation
Update Jenkins to a version that includes the fix restricting object types. Also limit Overall/Manage permissions to trusted administrators only.
Original NVD description (English source)
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.