CVE-2026-70431 Overview
CVE-2026-70431 affects the Jenkins Multijob Plugin version 669.v9d96a_d9c71b_0 and earlier. The plugin exposes Groovy scripting features that do not integrate with the Script Security Plugin. Attackers holding Item/Create or Item/Configure permission can execute arbitrary code within the Jenkins controller Java Virtual Machine (JVM). The flaw is classified as [CWE-94] Improper Control of Generation of Code (Code Injection).
Critical Impact
Authenticated users with job configuration rights can run arbitrary Groovy code on the Jenkins controller, compromising build pipelines, stored credentials, and downstream systems.
Affected Products
- Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier
- Jenkins controllers running vulnerable Multijob Plugin releases
- CI/CD environments dependent on Multijob-managed pipelines
Discovery Timeline
- 2026-08-05 - Jenkins publishes Security Advisory SECURITY-3823
- 2026-08-05 - CVE-2026-70431 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-70431
Vulnerability Analysis
The Multijob Plugin provides Groovy scripting inputs used to control job orchestration logic. These entry points evaluate Groovy expressions directly in the Jenkins controller JVM. Because the plugin does not delegate evaluation to the Script Security Plugin, submitted scripts bypass sandboxing and administrator approval workflows.
An attacker with Item/Create or Item/Configure permission can supply a Groovy payload through a job configuration and trigger execution on the controller. The controller JVM has access to build agents, secrets stored in the Jenkins credentials store, and any network resources reachable from the CI/CD environment.
Exploitation requires low-privilege authenticated access rather than administrative rights, which broadens the practical attack surface in multi-tenant Jenkins deployments where developers routinely receive job configuration permissions.
Root Cause
The root cause is missing integration with the Script Security Plugin. Groovy inputs supplied through the Multijob Plugin are evaluated without sandbox enforcement or the standard script approval mechanism that Jenkins uses to gate untrusted code. See the Jenkins Security Advisory 2026-08-05 for the vendor description.
Attack Vector
Exploitation occurs over the network against the Jenkins web interface. The attacker authenticates with an account holding Item/Create or Item/Configure, creates or modifies a Multijob-based job, and embeds Groovy code in a plugin-provided script field. When the job is saved or executed, the controller evaluates the payload with the privileges of the Jenkins process. Detailed reproduction steps are not published; refer to the vendor advisory for technical specifics.
Detection Methods for CVE-2026-70431
Indicators of Compromise
- Unexpected Groovy script content added to Multijob job configurations by non-administrator accounts.
- New or modified jobs created by users with only Item/Create or Item/Configure permission followed by build executions that spawn shell, java, or network processes on the controller.
- Outbound connections from the Jenkins controller host to unfamiliar destinations shortly after job configuration changes.
Detection Strategies
- Inventory installed plugin versions and flag any Jenkins controller running Multijob Plugin 669.v9d96a_d9c71b_0 or earlier.
- Review Jenkins audit logs for config.xml changes to Multijob-based jobs and correlate the changing user against expected roles.
- Alert on child processes of the Jenkins controller JVM that are inconsistent with normal build activity, such as reverse shells or credential-dumping utilities.
Monitoring Recommendations
- Forward Jenkins system, audit, and job configuration logs to a centralized logging platform for retention and correlation.
- Monitor the Jenkins credentials store for unexpected reads or exports following job changes.
- Track outbound egress from Jenkins controllers and compare against a known-good baseline of build dependencies.
How to Mitigate CVE-2026-70431
Immediate Actions Required
- Upgrade the Multijob Plugin to a fixed release once published in the Jenkins Security Advisory 2026-08-05.
- Restrict Item/Create and Item/Configure permissions to trusted users while a fix is being deployed.
- Audit existing Multijob job configurations for unauthorized Groovy content and remove suspicious entries.
Patch Information
Refer to the Jenkins Security Advisory 2026-08-05 (SECURITY-3823) for the fixed plugin version and upgrade instructions. Apply the update on all Jenkins controllers that have the Multijob Plugin installed.
Workarounds
- Remove or disable the Multijob Plugin on controllers where it is not required.
- Enforce least-privilege authorization using Jenkins Role-Based Access Control so only vetted users can create or configure jobs.
- Isolate the Jenkins controller on a segmented network with strict egress filtering to limit the blast radius of controller-side code execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
