CVE-2026-70430: Jenkins Privilege Escalation Vulnerability

CVE-2026-70430 Overview

CVE-2026-70430 affects Jenkins 2.575 and earlier, and Jenkins LTS 2.568.1 and earlier. The vulnerability stems from Jenkins failing to restrict the types of objects that can be instantiated as part of the project naming strategy configuration. Attackers holding the Overall/Manage permission can instantiate arbitrary configuration-related types, including those intended for administrator-only use. This flaw expands the effective privileges of non-administrator users who hold delegated management rights on the controller.

Critical Impact
Users with Overall/Manage permission can instantiate arbitrary configuration objects on the Jenkins controller, bypassing the administrator-only boundary intended for sensitive configuration types.

Affected Products

Jenkins 2.575 and earlier
Jenkins LTS 2.568.1 and earlier
Jenkins controllers where Overall/Manage permission is delegated to non-administrators

Discovery Timeline

2026-08-05 - Jenkins Security Advisory published as SECURITY-3916
2026-08-05 - CVE-2026-70430 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70430

Vulnerability Analysis

Jenkins allows administrators to configure a project naming strategy that governs how new job names are validated. The configuration form deserializes user-supplied form data into Java objects representing the naming strategy. In affected versions, the deserialization path does not restrict which object types can be instantiated. A user holding Overall/Manage permission can submit a crafted configuration and cause the controller to construct objects that were designed to be created only by administrators. This weakens the separation between the Overall/Administer and Overall/Manage permissions introduced in earlier Jenkins releases.

Root Cause

The project naming strategy configuration path accepts arbitrary type descriptors during form submission. Jenkins does not enforce a type allowlist scoped to naming-strategy classes. As a result, unrelated configuration types accessible through the descriptor registry can be instantiated during the save operation. This is a form of missing type restriction on deserialization, related to [CWE-502].

Attack Vector

The attack requires an authenticated user with the Overall/Manage permission. The attacker navigates to the global security configuration and submits a modified form referencing a class outside the intended naming-strategy hierarchy. Jenkins constructs the object using standard descriptor lookup, applying attacker-controlled properties. The impact depends on which configuration classes are reachable through this instantiation path on the target instance. See the Jenkins Security Advisory 2026-08-05 for the vendor description.

No public proof-of-concept code is referenced in the advisory, and the vulnerability is described in prose rather than through a released exploit artifact.

Detection Methods for CVE-2026-70430

Indicators of Compromise

Unexpected changes to the global security configuration, specifically the project naming strategy section, performed by non-administrator accounts
Audit log entries showing config.xml writes on the controller originating from users holding only Overall/Manage
New or altered descriptor references in jenkins.model.GlobalProjectNamingStrategyConfiguration or related sections of config.xml

Detection Strategies

Compare current controller config.xml against known-good baselines and flag unexpected class references under the naming strategy element
Review Jenkins audit logs and the Audit Trail plugin output for configSubmit calls to /manage/configure by non-administrators
Enumerate all accounts holding Overall/Manage and correlate their session activity with configuration change events

Monitoring Recommendations

Forward Jenkins controller logs and audit trail events to a centralized SIEM for retention and correlation
Alert on any modification to global security configuration by accounts that are not members of the administrator group
Track the Jenkins version banner exposed at /api/json to identify controllers still running affected releases

How to Mitigate CVE-2026-70430

Immediate Actions Required

Upgrade Jenkins weekly to 2.576 or later, or Jenkins LTS to 2.568.2 or later, as directed by the Jenkins Security Advisory
Inventory all users and groups granted the Overall/Manage permission and remove the grant where it is not required
Review the current project naming strategy configuration for unexpected object types and revert to a known-good state if changes are found

Patch Information

Jenkins has published fixes as part of Security Advisory SECURITY-3916. Refer to the Jenkins Security Advisory 2026-08-05 for the fixed version list and upgrade guidance. Apply the update on the controller; agents do not require patching for this issue.

Workarounds

Restrict the Overall/Manage permission to trusted administrators until the controller is upgraded
Disable delegated management by using authorization strategies that grant only Overall/Read to non-administrator users
Place the Jenkins controller behind network controls that limit configuration endpoint access to administrative networks

bash

# Example: list users and their permissions via Jenkins CLI script console
# Run in Manage Jenkins > Script Console (as administrator)
import jenkins.model.Jenkins
import hudson.security.Permission

def manage = Jenkins.MANAGE
Jenkins.instance.securityRealm.allUsers.each { u ->
  def auth = Jenkins.instance.authorizationStrategy
  if (auth.hasPermission(u.impersonate2(), manage)) {
    println "User with Overall/Manage: ${u.id}"
  }
}