CVE-2026-70434 Overview
CVE-2026-70434 is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins SCM-Manager Plugin version 1.11.1 and earlier. The flaw allows attackers to induce authenticated Jenkins users to submit forged requests. These requests connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. The attack captures credentials stored in Jenkins and forwards them to the attacker-controlled destination. The vulnerability is documented in the Jenkins Security Advisory SECURITY-3888.
Critical Impact
Attackers can exfiltrate Jenkins-stored credentials by tricking authenticated users into triggering forged connection requests to attacker-controlled endpoints.
Affected Products
- Jenkins SCM-Manager Plugin version 1.11.1
- Jenkins SCM-Manager Plugin versions prior to 1.11.1
- Jenkins instances with the SCM-Manager Plugin installed and enabled
Discovery Timeline
- 2026-08-05 - CVE CVE-2026-70434 published to NVD
- 2026-08-05 - Jenkins Security Advisory SECURITY-3888 released
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70434
Vulnerability Analysis
The Jenkins SCM-Manager Plugin exposes a connection-test endpoint that does not require POST requests or valid CSRF crumbs. An attacker crafts a malicious web page or link containing a forged request targeting this endpoint. When an authenticated Jenkins user visits the malicious content, their browser submits the request with active Jenkins session cookies. The server processes the request as legitimate and initiates a connection to the attacker-specified URL. During this connection, Jenkins attaches the credentials referenced by the attacker-supplied credentials ID. The attacker's server captures the transmitted credentials, effectively exfiltrating secrets stored in Jenkins.
Root Cause
The root cause is missing CSRF protection [CWE-352] on the connection-test endpoint in the SCM-Manager Plugin. The plugin accepts GET requests or requests without a CSRF crumb for security-sensitive actions that use stored credentials. This design allows cross-origin attackers to leverage a victim's authenticated Jenkins session to perform actions the victim did not authorize.
Attack Vector
Exploitation requires an authenticated Jenkins user with permissions to use the affected form validation endpoint to visit an attacker-controlled page. The attacker must also possess a valid credentials ID, typically obtained through information disclosure, prior access, or enumeration. The attack executes silently in the victim's browser and requires no privilege elevation on the attacker's side. Credentials captured this way may include SCM tokens, deployment keys, or service account passwords stored in Jenkins.
No verified proof-of-concept code is publicly available. See the Jenkins Security Advisory SECURITY-3888 for vendor-provided technical details.
Detection Methods for CVE-2026-70434
Indicators of Compromise
- Outbound connections from Jenkins controllers to unexpected or untrusted external hosts, particularly from SCM-Manager Plugin components.
- Jenkins access logs showing form validation requests referencing SCM-Manager endpoints with unusual url or credentialsId parameters.
- Referer headers on connection-test requests pointing to external domains rather than the Jenkins UI.
Detection Strategies
- Review Jenkins audit logs for form validation endpoint invocations that correlate with user browsing sessions on non-Jenkins domains.
- Monitor for repeated connection attempts to unique external hosts using different credentialsId values, which suggests credential enumeration.
- Correlate SCM-Manager Plugin activity with network egress data to identify unauthorized destinations.
Monitoring Recommendations
- Enable Jenkins access logging and forward events to a centralized log platform for analysis and retention.
- Alert on outbound connections from the Jenkins controller to hosts outside an approved SCM allowlist.
- Track credential usage patterns and flag anomalous spikes in credential retrieval operations tied to form validation endpoints.
How to Mitigate CVE-2026-70434
Immediate Actions Required
- Upgrade the Jenkins SCM-Manager Plugin to a version later than 1.11.1 once a fixed release is available per the vendor advisory.
- Rotate any credentials stored in Jenkins that may have been referenced by users during the exposure window.
- Restrict Overall/Read and job configuration permissions to trusted users to limit the pool of potential CSRF victims.
Patch Information
Refer to the Jenkins Security Advisory SECURITY-3888 for the current fixed version and upgrade instructions. Apply the vendor-supplied patch to all Jenkins controllers running the SCM-Manager Plugin.
Workarounds
- Disable the SCM-Manager Plugin until the patched version is applied if the plugin is not actively required.
- Restrict Jenkins access to trusted internal networks using network-layer controls to reduce the attack surface for CSRF.
- Advise Jenkins users to avoid browsing untrusted sites in the same browser session used for Jenkins administration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
