CVE-2026-70435

MediumCVSS 4.2

Published: 05/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Risk Assessment

Attackers can capture credentials, leading to unauthorized access to systems and data.

Recommendation

Update the plugin to a patched version if available, and restrict Overall/Read permissions.

Other vulnerabilities in Jenkins SCM-Manager Plugin

CVE-2026-70434Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS