CVE-2026-70443 Jenkins Project CVE debrief

Who should care

Jenkins administrators, security teams, and users with Item/Configure permissions should be aware of this vulnerability. They should review the official CVE record and assess their deployments for potential exposure. Affected operators and platforms should prioritize patching and review compensating controls for exposed systems. Vulnerability management and security teams should monitor for suspicious credential usage and track exceptions for remediated assets.

Technical summary

Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL. This issue can lead to potential credential misuse. The vulnerability is related to improper handling of credentials in the plugin, and administrators should prioritize patching the plugin to prevent this vulnerability. Affected operators and platforms should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Administrators should prioritize patching Jenkins Horreum Plugin to prevent potential credential misuse.

Recommended defensive actions

• Patch Jenkins Horreum Plugin to version beyond 0.16.162.v33b_4a_a_b_5f828
• Restrict Item/Configure permissions to trusted users
• Monitor Jenkins for suspicious credential usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup. This allows attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL. Evidence is limited, and defenders should verify affected deployments, review official advisories, and monitor for suspicious credential usage.

Official resources