CVE-2026-70438

MediumCVSS 4.3

Published: 05/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Risk Assessment

Disclosure of credential IDs can facilitate further attacks, including credential theft.

Recommendation

Update the plugin to a patched version if available, and restrict Overall/Read permissions.

Other vulnerabilities in Jenkins Parameterized Remote Trigger Plugin

CVE-2026-84676Medium
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS