Stored Cross-Site Scripting Vulnerability in Jenkins Qualys Container Scanning Connector Plugin
CVE-2026-70440

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins Qualys Container Scanning Connector Plugin
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70440?

The Jenkins Qualys Container Scanning Connector Plugin allows attackers with Item/Configure permission to exploit an unescaped JavaScript context, leading to a stored cross-site scripting vulnerability. This flaw permits the injection of malicious scripts, potentially compromising user interactions and data integrity within the Jenkins environment, affecting users' trust and application functionality.

Affected Version(s)

Jenkins Qualys Container Scanning Connector Plugin 0 <= 1.8.0.5

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.