CVE-2026-70434

highCVSS 4.2covered by 3 sourcesfirst seen 2026-08-05

Affects Jenkins Core Affects plugin: AWS CodeBuild Affects plugin: CodeSonar Affects plugin: External Workspace Manager Affects plugin: Google Chat Notification Affects plugin: HCL AppScan Affects plugin: Horreum Affects plugin: Ivy Report Affects plugin: Multijob Affects plugin: Parameterized Remote Trigger Affects plugin: Qualys Container Scanning Connector Affects plugin: Sauce OnDemand Affects plugin: SCM-Manager Affects plugin: Summary Display Affects plugin: Violation Comments to GitLab Affects plugin: Webhook Secret Credentials Provider Affects plugin: XML Job to Job DSL

CSIRTS triage

What: Multiple unspecified vulnerabilities affect Jenkins Core and 15 associated plugins.
Who is affected: Deployments of Jenkins Core and users of AWS CodeBuild, CodeSonar, External Workspace Manager, Google Chat Notification, HCL AppScan, Horreum, Ivy Report, Multijob, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, SCM-Manager, Summary Display, Violation Comments to GitLab, and Webhook Secret Credentials Provider plugins.
Urgency: Severity unknown; eight CVEs assigned indicate multiple impact vectors requiring immediate investigation.
Action: Consult Jenkins Security Advisory 2026-08-05 for specific vulnerability details and apply recommended patches for Core and affected plugins.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-70434

Get an email if CVE-2026-70434 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Advisory coverage (3)

high[NEW] [high] Jenkins Plugins: Multiple vulnerabilitiescert-bund · 2026-08-06
mediumCVE-2026-70434: A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and ear…nvd · 2026-08-05
unknownJenkins Security Advisory 2026-08-05jenkins · 2026-08-05

External references

NVD record for CVE-2026-70434

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-70434 status](https://www.csirts.com/badge/CVE-2026-70434)](https://www.csirts.com/cve/CVE-2026-70434)