CVE-2026-70447 is a security vulnerability in the Jenkins AWS CodeBuild Plugin (version 0.59 and earlier) where missing permission checks permit attackers who have Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. This enumeration could potentially aid attackers in further attacks by revealing credential identifiers. The vulnerability affects the plugin in cloud service deployments. Although no CVSS score is provided, the vendor has indicated a patch is available. There are no known exploits in the wild at this time.

Attackers with Overall/Read permission can enumerate credential IDs stored in Jenkins, potentially exposing sensitive information about stored credentials. This could facilitate further attacks if combined with other vulnerabilities or misconfigurations. However, the vulnerability does not directly allow credential access or modification, only enumeration of credential IDs.

A patch is available for this vulnerability. Since this is a cloud service plugin, the vendor typically manages remediation server-side. Users should apply the official patch or update the Jenkins AWS CodeBuild Plugin to a version later than 0.59 to mitigate this issue. Check the vendor advisory for the latest remediation guidance.