CVE-2026-70431
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Risk Assessment
Users with limited permissions can execute arbitrary code on the Jenkins server, potentially leading to privilege escalation and full server compromise.
Recommendation
It is recommended to update the Multijob Plugin to a version that integrates with Script Security Plugin. Also, restrict Item/Create and Item/Configure permissions to trusted users only.
Other vulnerabilities in Jenkins Multijob Plugin
See all- CVE-2026-70432High
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
- CVE-2026-9674Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.
Original NVD description (English source)
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS