CVE-2026-70432
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
Risk Assessment
An attacker could exploit CSRF to execute arbitrary code on the Jenkins server, potentially leading to full server compromise and affecting all managed projects.
Recommendation
It is recommended to immediately update the Multijob Plugin to a version newer than 669.v9d96a_d9c71b_0. Additionally, enable CSRF protection in Jenkins and use mechanisms to prevent CSRF attacks.
Other vulnerabilities in Jenkins Multijob Plugin
See all- CVE-2026-70431High
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
- CVE-2026-9674Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.
Original NVD description (English source)
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS