CVE-2026-70432

HighCVSS 8.8

Published: 05/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

Risk Assessment

An attacker could exploit CSRF to execute arbitrary code on the Jenkins server, potentially leading to full server compromise and affecting all managed projects.

Recommendation

It is recommended to immediately update the Multijob Plugin to a version newer than 669.v9d96a_d9c71b_0. Additionally, enable CSRF protection in Jenkins and use mechanisms to prevent CSRF attacks.

Other vulnerabilities in Jenkins Multijob Plugin

CVE-2026-70431High
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.