Missing Permission Check in Jenkins Parameterized Remote Trigger Plugin
CVE-2026-70438

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins Parameterized Remote Trigger Plugin
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70438?

A vulnerability exists in the Jenkins Parameterized Remote Trigger Plugin that allows users with Overall/Read permission to enumerate stored credential IDs. This could lead to unauthorized disclosure of sensitive information, compromising the integrity and security of the Jenkins environment.

Affected Version(s)

Jenkins Parameterized Remote Trigger Plugin 0 <= 3.2.2

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.