CVE-2026-70430

2.7 Faible

Publiée le 05/08/2026 à 20:17 · Modifiée le 08/09/2026 à 22:04 · Analysée par le NVD · Source : jenkinsci-cert@googlegroups.com

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

Traduire en français

Produits concernés

Jenkins Project Jenkins
Jenkins jenkins

Scores CVSS

Version	Score	Source	Vecteur
3.1	2.7 Faible	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-284

Références

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3916 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories