CVE-2026-70435 is a vulnerability in the Jenkins SCM-Manager Plugin (version 1.11.1 and earlier) caused by a missing permission check. Attackers who have Overall/Read permission can exploit this flaw to connect to a URL specified by the attacker using credentials IDs that the attacker has obtained through other methods. This can lead to the exposure of credentials stored within Jenkins. The vulnerability is classified under CWE-862 (Missing Authorization). There is no official remediation or patch currently documented for this issue, and no known exploits are reported in the wild.

The vulnerability allows an attacker with limited permissions (Overall/Read) to misuse credentials stored in Jenkins by connecting to attacker-specified URLs with those credentials. This could lead to unauthorized disclosure of sensitive credentials, impacting confidentiality. The integrity and availability impacts are rated low or none. The overall severity is medium (CVSS 4.2).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Overall/Read permissions to trusted users only and monitor for suspicious activity related to credential usage. Avoid granting unnecessary permissions that could be leveraged to exploit this vulnerability.