CVE-2026-70439

MEDIUM

Jenkins XML Job to Job DSL Plugin < 0.1.13 - Unauthenticated Job Conversion via Missing Permission Check

Title source: llm
STIX 2.1

Description

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-08-05
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3779

Scores

CVSS v3 6.5
EPSS 0.0016
EPSS Percentile 5.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
Jenkins Project/Jenkins XML Job to Job DSL Plugin < 0.1.13
Published Aug 05, 2026
Tracked Since Aug 05, 2026