CVE-2026-70434

MediumCVSS 4.2

Published: 05/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Risk Assessment

Attackers can exploit CSRF to capture credentials, leading to unauthorized access to systems and data.

Recommendation

Update the plugin to a patched version if available, and implement CSRF protection mechanisms such as CSRF tokens.

Other vulnerabilities in Jenkins SCM-Manager Plugin

CVE-2026-70435Medium
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS