Credential Misconfiguration in Jenkins Horreum Plugin
CVE-2026-70443

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins Horreum Plugin
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70443?

The Jenkins Horreum Plugin prior to version 0.16.162 is vulnerable due to inadequate context settings for credential lookups. This flaw permits users with Item/Configure permissions to improperly access and transmit credentials to the configured Horreum URL, which they are not authorized to manage. This misconfiguration poses significant risks to sensitive data integrity within Jenkins environments, making it imperative for administrators to assess and patch affected instances promptly.

Affected Version(s)

Jenkins Horreum Plugin 0 <= 0.16.162.v33b_4a_a_b_5f828

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.