CVE-2026-70432: Jenkins Multijob Plugin CSRF Vulnerability

CVE-2026-70432 Overview

CVE-2026-70432 is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins Multijob Plugin version 669.v9d96a_d9c71b_0 and earlier. The flaw allows attackers to execute arbitrary code in the context of the Jenkins controller Java Virtual Machine (JVM). Exploitation requires an authenticated Jenkins user to visit an attacker-controlled page while logged into a vulnerable instance. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation results in arbitrary code execution within the Jenkins controller JVM, enabling full compromise of the automation server and any secrets, credentials, or build pipelines it manages.

Affected Products

Jenkins Multijob Plugin version 669.v9d96a_d9c71b_0
All prior versions of the Jenkins Multijob Plugin
Jenkins controllers with the vulnerable plugin installed

Discovery Timeline

2026-08-05 - CVE-2026-70432 published to NVD alongside Jenkins Security Advisory SECURITY-3823
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70432

Vulnerability Analysis

The Jenkins Multijob Plugin exposes an HTTP endpoint that lacks CSRF protection and does not require the appropriate POST request method. An attacker can craft a malicious web page that, when visited by an authenticated Jenkins user, submits a forged request to the vulnerable Jenkins instance. The request is processed with the victim's privileges, triggering code execution within the Jenkins controller JVM.

Because Jenkins controllers typically hold administrative credentials, SSH keys, cloud provider tokens, and pipeline definitions, arbitrary code execution on the controller allows an attacker to pivot into connected build agents, source code repositories, artifact stores, and downstream production systems. The plugin is commonly deployed in continuous integration and continuous delivery (CI/CD) environments, expanding the potential blast radius.

Root Cause

The root cause is a missing CSRF token check on a state-changing HTTP handler within the Multijob Plugin, combined with acceptance of GET requests where POST should be required. Jenkins provides built-in CSRF crumb validation, but the affected endpoint did not enforce it. This omission allows cross-origin requests to invoke controller-side functionality that leads to code execution.

Attack Vector

Exploitation is network-based and requires low attacker privileges paired with a social engineering component to lure an authenticated Jenkins user. The attacker hosts a page containing a hidden form or automatic request targeting the vulnerable Multijob endpoint on the victim's Jenkins instance. When the victim's browser sends the forged request, the browser attaches the victim's Jenkins session cookies, and the controller processes the request as legitimate. No direct authentication to Jenkins by the attacker is required beyond the victim's session context. See the Jenkins Security Advisory for the affected endpoint details.

Detection Methods for CVE-2026-70432

Indicators of Compromise

Unexpected Multijob Plugin HTTP requests in Jenkins access logs originating from external Referer headers or unusual browser user-agents.
Unscheduled job creation, modification, or execution events in Jenkins audit logs tied to Multijob configurations.
Child processes spawned by the Jenkins controller JVM (java) that execute shell interpreters, curl, wget, or reverse shell tooling.
Outbound network connections from the Jenkins controller to unrecognized hosts shortly after a user session interacted with an external site.

Detection Strategies

Monitor Jenkins access.log and audit logs for GET requests to Multijob Plugin endpoints that should require POST with a valid crumb.
Alert on new or modified Multijob build configurations correlated with a single user session and an external HTTP referrer.
Use endpoint telemetry to flag Jenkins controller processes spawning unexpected child processes, particularly interpreters or network utilities.

Monitoring Recommendations

Forward Jenkins controller logs, system logs, and process telemetry to a centralized analytics platform for correlation and retention.
Baseline normal Multijob Plugin usage patterns and alert on deviations such as off-hours configuration changes or novel source IPs.
Track plugin inventory and version drift on Jenkins controllers so that vulnerable Multijob Plugin builds are surfaced automatically.

How to Mitigate CVE-2026-70432

Immediate Actions Required

Inventory all Jenkins controllers and identify instances running Multijob Plugin 669.v9d96a_d9c71b_0 or earlier.
Upgrade the Multijob Plugin to the fixed release referenced in the Jenkins Security Advisory as soon as it becomes available.
Rotate credentials, API tokens, and SSH keys stored on any Jenkins controller suspected of exposure, especially those reachable from user browsers.
Restrict Jenkins UI access to trusted networks or place it behind an authenticated reverse proxy to reduce exposure to CSRF lures.

Patch Information

Administrators should apply the vendor-provided plugin update referenced in the Jenkins Security Advisory SECURITY-3823 published on 2026-08-05. Consult the advisory for the specific fixed version and release notes before deployment: Jenkins Security Advisory SECURITY-3823.

Workarounds

If patching is not immediately possible, disable the Multijob Plugin through the Jenkins plugin manager until a fixed version is installed.
Enforce Jenkins CSRF protection globally and confirm that anonymous read access is disabled to reduce the attack surface.
Instruct Jenkins users to log out of Jenkins when not actively using it, and consider isolating administrative sessions to a dedicated browser profile.

bash

# Configuration example: list installed plugins and disable Multijob via the Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ -auth @token.txt list-plugins | grep -i multijob
java -jar jenkins-cli.jar -s https://jenkins.example.com/ -auth @token.txt disable-plugin jenkins-multijob-plugin -restart