CVE-2026-70429

6.5 Moyenne

Publiée le 05/08/2026 à 20:17 · Modifiée le 08/09/2026 à 22:10 · Analysée par le NVD · Source : jenkinsci-cert@googlegroups.com

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

Traduire en français

Produits concernés

Jenkins Project Jenkins
Jenkins jenkins

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N`
3.1	8.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-178

Références

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories