CVE-2026-70430 — Jenkins Project / Jenkins

CVE-2026-70430

Jenkins Project / Jenkins PUBLISHED

Description (CNA)

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins	unaffected 2.576 before ; unaffected 2.568.2 before 2.568.

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3916

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.