nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-70437 CVE-2026-70437
LOW
Jenkins Webhook Secret Credentials Provider Plugin Non-Constant-Time Token Comparison
Record summary
CVE-2026-70437 has a selected CVSS score of 3.7 (low).
Description
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Jenkins Webhook Secret Credentials Provider PluginBrowse Jenkins Project / Jenkins Webhook Secret Credentials Provider PluginDefault status: unaffected | CVE List | Through 16.v0cfa_f0215cf5 | affected |
References
2Jenkins Security Advisory 2026-08-05Vendor advisory
https://www.jenkins.io/security/advisory/2026-08-05