CVE-2026-70429: Vulnerability in Jenkins Project Jenkins
Jenkins versions 2.575 and earlier, including LTS 2.568.1 and earlier, have an inconsistent handling of case-insensitivity in user and group names. This flaw allows attackers who can create new users or groups with names that case-insensitively match existing ones to impersonate those users or gain their permissions under certain conditions. The vulnerability is identified as CWE-178 and has a high severity with a CVSS score of 8.1.
AI Analysis
Technical Summary
CVE-2026-70429 is a vulnerability in Jenkins where case-insensitivity in user and group names is handled inconsistently. Attackers able to create new users or groups with names that case-insensitively match existing ones can impersonate other users or be granted their permissions in some scenarios. This issue affects Jenkins versions prior to 2.576 and LTS versions prior to 2.568.2. The vulnerability has a high CVSS score of 8.1, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation level has been confirmed in the provided data.
Potential Impact
An attacker with the ability to create new users or groups can exploit this vulnerability to impersonate other users or gain their permissions due to inconsistent case-insensitive handling of names. This can lead to unauthorized access and potentially full compromise of the Jenkins environment, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to create new users or groups to trusted administrators only to reduce the risk of exploitation.
CVE-2026-70429: Vulnerability in Jenkins Project Jenkins
Description
Jenkins versions 2.575 and earlier, including LTS 2.568.1 and earlier, have an inconsistent handling of case-insensitivity in user and group names. This flaw allows attackers who can create new users or groups with names that case-insensitively match existing ones to impersonate those users or gain their permissions under certain conditions. The vulnerability is identified as CWE-178 and has a high severity with a CVSS score of 8.1.
CVSS v3.1
Score 8.1high
Affected software
Jenkins Project
Jenkins
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70429 is a vulnerability in Jenkins where case-insensitivity in user and group names is handled inconsistently. Attackers able to create new users or groups with names that case-insensitively match existing ones can impersonate other users or be granted their permissions in some scenarios. This issue affects Jenkins versions prior to 2.576 and LTS versions prior to 2.568.2. The vulnerability has a high CVSS score of 8.1, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation level has been confirmed in the provided data.
Potential Impact
An attacker with the ability to create new users or groups can exploit this vulnerability to impersonate other users or gain their permissions due to inconsistent case-insensitive handling of names. This can lead to unauthorized access and potentially full compromise of the Jenkins environment, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to create new users or groups to trusted administrators only to reduce the risk of exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-08-04T14:13:20.602Z
- State
- PUBLISHED
Threat ID: 6a737983bf8831d5393d6c44
Added to database: 08/05/2026, 17:57:23 UTC
Last enriched: 08/13/2026, 17:25:10 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.