Inconsistent Case-Insensitivity Vulnerability in Jenkins by CloudBees

CVE-2026-70429

What is CVE-2026-70429?

Jenkins creates a security issue by mishandling case-insensitivity in usernames and group names. This flaw permits attackers to create new users or groups whose names match existing ones case-insensitively, potentially allowing them to impersonate valid users and gain access to their permissions. Such behavior can lead to unchecked privilege escalation, posing significant risks to the integrity and confidentiality of user data within the Jenkins environment.

References