CVE-2026-70433: Jenkins HCL AppScan Plugin Vulnerability

CVE-2026-70433 Overview

CVE-2026-70433 is a missing permission check vulnerability in the Jenkins HCL AppScan Plugin version 1.8.3 and earlier. The flaw allows attackers holding only Overall/Read permission to enumerate credential IDs of credentials stored in Jenkins. Credential ID enumeration provides reconnaissance data that attackers can pair with other weaknesses to target specific secrets. The issue was disclosed in the Jenkins Security Advisory 2026-08-05 under tracker SECURITY-3771.

Critical Impact
Authenticated users with minimal read-level access can enumerate stored Jenkins credential identifiers through the HCL AppScan Plugin, exposing secrets metadata for follow-on attacks.

Affected Products

Jenkins HCL AppScan Plugin version 1.8.3
Jenkins HCL AppScan Plugin versions earlier than 1.8.3
Jenkins controllers with the vulnerable plugin installed

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3771
2026-08-05 - CVE-2026-70433 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70433

Vulnerability Analysis

The Jenkins HCL AppScan Plugin exposes form-related HTTP endpoints used to select credentials during job or plugin configuration. These endpoints must verify that the requesting user holds sufficient permission before returning credential metadata. In version 1.8.3 and earlier, the plugin omits those checks. Any authenticated user with Overall/Read permission can invoke the endpoints and receive a list of credential IDs stored in Jenkins.

Credential IDs by themselves do not disclose secret values. They do, however, reveal which credential objects exist, their identifiers, and, in many deployments, hints about the systems they authorize. Attackers use this data to prioritize secondary attacks against credential stores, related plugins, or misconfigured jobs.

Root Cause

The root cause is missing authorization enforcement [CWE-862] on plugin HTTP endpoints that populate credential selection controls. The endpoints should require a permission such as Item/Configure or Credentials/View, but the plugin returns results to any authenticated caller with baseline read access.

Attack Vector

An attacker first obtains an authenticated Jenkins account with Overall/Read permission. This permission is commonly granted to broad user populations in shared Jenkins environments. The attacker then issues HTTP requests to the plugin's credential-listing endpoints and parses the returned credential IDs. The vulnerability requires authentication but no elevated role, no user interaction, and no code execution primitive.

No public proof-of-concept or in-the-wild exploitation is documented in the advisory. Refer to the Jenkins Security Advisory 2026-08-05 for endpoint-level details.

Detection Methods for CVE-2026-70433

Indicators of Compromise

Unusual HTTP GET requests from low-privilege Jenkins users to plugin form-fill or credential list endpoints associated with the HCL AppScan Plugin.
Access log entries showing repeated credential enumeration requests from a single session or IP.
Jenkins audit events showing Overall/Read accounts touching configuration-adjacent URLs they do not normally use.

Detection Strategies

Enable and forward Jenkins access logs and audit trail entries to a centralized logging platform for query and correlation.
Baseline which user accounts legitimately configure jobs using the HCL AppScan Plugin, then alert on other accounts hitting its form endpoints.
Correlate credential enumeration attempts with subsequent job configuration changes or credential usage events.

Monitoring Recommendations

Monitor the installed version of the HCL AppScan Plugin across all Jenkins controllers and flag versions at or below 1.8.3.
Track the population of users granted Overall/Read and review whether the scope is broader than required.
Alert on spikes in requests to plugin descriptor URLs or fillCredentialsIdItems-style endpoints.

How to Mitigate CVE-2026-70433

Immediate Actions Required

Inventory Jenkins controllers and identify installations of the HCL AppScan Plugin at version 1.8.3 or earlier.
Restrict Overall/Read permission to trusted users until the plugin is updated.
Rotate credentials stored in Jenkins if logs indicate enumeration by unauthorized accounts.
Review credential scoping so plugin jobs use folder-scoped credentials rather than global ones.

Patch Information

Jenkins has published the fix through the Jenkins Security Advisory 2026-08-05. Update the HCL AppScan Plugin to a version later than 1.8.3 as listed in the advisory. Apply the update through the Jenkins Plugin Manager and restart the controller if required.

Workarounds

Uninstall or disable the HCL AppScan Plugin on controllers where it is not actively used.
Reduce membership in roles that grant Overall/Read to limit the attacker pool.
Move sensitive credentials to folder-scoped stores so global enumeration returns fewer high-value IDs.

bash

# Configuration example
# List installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i appscan

# Upgrade the HCL AppScan Plugin to the fixed release
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin appscan -restart