Arbitrary Object Instantiation in Jenkins Project Naming Strategy
CVE-2026-70430

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70430?

An issue in Jenkins versions up to 2.575 and LTS versions up to 2.568.1 allows users with Overall/Manage permissions to instantiate arbitrary object types in the project naming strategy configuration. This vulnerability permits unauthorized users to manipulate configurations meant solely for administrators, potentially leading to further security breaches.

Affected Version(s)

Jenkins 2.576

Jenkins 2.576

Jenkins 2.568.2 < 2.568.*

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.