Missing Permission Checks in Jenkins AWS CodeBuild Plugin

CVE-2026-70447

What is CVE-2026-70447?

The Jenkins AWS CodeBuild Plugin, specifically version 0.59 and earlier, has a security flaw due to missing permission checks. This vulnerability allows individuals with Overall/Read permissions to exploit the system and enumerate credential IDs stored in Jenkins. Such exposure could lead to further unauthorized access and compromise sensitive information. It is crucial for Jenkins users to address this issue promptly to safeguard their credentials.

References