CVE-2026-70429: Jenkins Auth Bypass Vulnerability

CVE-2026-70429 Overview

CVE-2026-70429 affects Jenkins, the widely deployed open-source automation server. Jenkins 2.575 and earlier, along with LTS releases 2.568.1 and earlier, handle case-insensitivity inconsistently across user names and group names. Attackers who can create new users or groups with names that case-insensitively match existing accounts can impersonate other users or inherit their permissions. The flaw enables authorization bypass on affected controllers where user or group registration is possible. Jenkins published advisory SECURITY-3924 documenting the issue on August 5, 2026.

Critical Impact
Attackers with account creation privileges can impersonate legitimate users or gain their permissions by registering accounts whose names differ only in letter casing.

Affected Products

Jenkins weekly releases 2.575 and earlier
Jenkins LTS releases 2.568.1 and earlier
Jenkins controllers permitting user or group creation

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3924
2026-08-05 - CVE-2026-70429 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70429

Vulnerability Analysis

Jenkins compares user and group identifiers inconsistently across authentication and authorization pathways. Some code paths treat identifiers as case-sensitive strings while others normalize to a common case for comparison. This inconsistency creates a mismatch between the identity presented at authentication and the identity used for permission lookups.

An attacker who registers an account named Admin on a system with an existing admin user can trigger conditions where Jenkins associates the attacker session with the legitimate account's permissions. The same issue applies to groups, allowing a newly created group to case-insensitively collide with a privileged group and inherit assigned rights.

The vulnerability is a broken access control weakness rooted in inconsistent identifier canonicalization. Exploitation requires the ability to create users or groups, which is available on Jenkins instances with open sign-up or on multi-tenant setups where attackers hold limited account creation rights.

Root Cause

Jenkins does not enforce a single canonical form for user and group identifiers across all subsystems. Authentication realms, authorization strategies, and permission stores apply different comparison rules. When one component uses case-sensitive matching and another uses case-insensitive matching, an identifier can satisfy both a lookup for the attacker account and a lookup for the victim account depending on execution path.

Attack Vector

Exploitation begins with the attacker creating a user or group whose name case-insensitively matches a target principal. The attacker then authenticates using the newly created identity. Downstream authorization checks resolve the identifier against the victim account and grant the attacker the victim's permissions. No memory corruption or code injection is required. Refer to the Jenkins Security Advisory SECURITY-3924 for vendor-provided technical details.

Detection Methods for CVE-2026-70429

Indicators of Compromise

Newly created user or group names that differ from existing accounts only in letter case, such as Admin alongside admin or BUILD alongside build.
Authentication events for accounts whose recorded username casing changes between logins.
Permission grants or job executions performed by low-privilege accounts that resolve to privileged identities in audit logs.

Detection Strategies

Enumerate all Jenkins users and groups and flag any pair whose identifiers match when compared case-insensitively.
Correlate account creation events in Jenkins audit logs with subsequent privileged actions performed by the same session.
Review authorization decisions logged by the security realm for identifier mismatches between the authenticated principal and the resolved permission subject.

Monitoring Recommendations

Alert on creation of Jenkins users or groups whose names collide case-insensitively with existing principals.
Monitor Jenkins controller logs for unexpected permission escalations following account registration.
Forward Jenkins audit and security logs to a centralized platform for correlation with identity events.

How to Mitigate CVE-2026-70429

Immediate Actions Required

Upgrade Jenkins weekly to a release later than 2.575 and Jenkins LTS to a release later than 2.568.1 as directed in advisory SECURITY-3924.
Disable open user sign-up on Jenkins controllers where it is not required for operations.
Audit existing users and groups for case-insensitive collisions and remove or rename duplicates.

Patch Information

Jenkins addressed CVE-2026-70429 in versions released alongside advisory SECURITY-3924 on August 5, 2026. Administrators should consult the Jenkins Security Advisory SECURITY-3924 for exact fixed version numbers and upgrade procedures.

Workarounds

Restrict the Overall/Administer and user creation permissions to trusted administrators until patches are applied.
Configure the security realm to reject new user or group names that case-insensitively match any existing principal.
Enforce a naming policy that disallows registration of identifiers differing only in case from reserved administrative accounts.

bash

# Configuration example: identify case-insensitive collisions in Jenkins users directory
ls $JENKINS_HOME/users/ | awk '{print tolower($0), $0}' | sort | \
  awk '{ if ($1 == prev1 && $2 != prev2) print prev2, $2; prev1=$1; prev2=$2 }'