CVE-2026-70431
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Risk Assessment
Users with limited permissions can execute arbitrary code on the Jenkins server, potentially leading to privilege escalation and full server compromise.
Recommendation
It is recommended to update the Multijob Plugin to a version that integrates with Script Security Plugin. Also, restrict Item/Create and Item/Configure permissions to trusted users only.
Other vulnerabilities in Jenkins Multijob Plugin
Original NVD description (English source)
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.