CVE-2026-70435: Jenkins SCM-Manager Auth Bypass Flaw

CVE-2026-70435 Overview

CVE-2026-70435 is a missing permission check vulnerability in the Jenkins SCM-Manager Plugin version 1.11.1 and earlier. The plugin fails to enforce adequate authorization on a connection-test endpoint. Attackers with only Overall/Read permission can supply an attacker-controlled URL along with a credentials ID obtained through another method. The plugin then connects to that URL using the referenced credentials, disclosing them to the attacker-controlled endpoint. This gives low-privileged Jenkins users a path to capture credentials stored inside Jenkins.

Critical Impact
Authenticated attackers holding Overall/Read permission can exfiltrate stored Jenkins credentials to an external server they control.

Affected Products

Jenkins SCM-Manager Plugin 1.11.1
Jenkins SCM-Manager Plugin earlier than 1.11.1

Discovery Timeline

2026-08-05 - CVE-2026-70435 published to NVD
2026-08-05 - Jenkins Security Advisory SECURITY-3888 released
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70435

Vulnerability Analysis

The Jenkins SCM-Manager Plugin exposes a connection-test function that accepts a target URL and a credentials ID as user-controlled input. The handler does not verify that the caller has permission to use the referenced credentials or to trigger outbound connections. Any authenticated user with Overall/Read, the lowest meaningful Jenkins permission, can invoke this handler. The plugin then loads the referenced credential from the Jenkins credentials store and transmits it to the specified URL as part of the connection attempt.

This pattern is a form of Broken Access Control combined with Server-Side Request Forgery (SSRF) semantics. The attacker does not need to already know the credential value. The attacker only needs the credential identifier, which is frequently visible in job configurations, build logs, or through other read-level views inside Jenkins.

Root Cause

The root cause is a missing authorization check on a form-validation or connection-test action. Jenkins plugins are expected to gate credential-consuming endpoints behind permissions such as Item/Configure or Credentials/Use. The affected handler in SCM-Manager Plugin 1.11.1 and earlier omits this check, defaulting to permission requirements that any authenticated user satisfies.

Attack Vector

An attacker authenticates to Jenkins with a low-privileged account holding Overall/Read. The attacker identifies a valid credentials ID stored in Jenkins, often available through job configuration exposure, build metadata, or another disclosure primitive. The attacker then invokes the SCM-Manager Plugin connection-test endpoint, supplying a URL that points to an attacker-controlled listener along with the target credentials ID. Jenkins retrieves the credential and sends it to the listener, either through an Authorization header, a URL parameter, or a body field, depending on the credential type.

A sanitized exploitation code example is not published here because no verified public proof-of-concept is available. Consult the Jenkins Security Advisory SECURITY-3888 for authoritative technical details.

Detection Methods for CVE-2026-70435

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Jenkins controller to unfamiliar external hosts originating from the SCM-Manager Plugin.
Jenkins audit log entries showing connection-test or form-validation calls from accounts that do not typically configure jobs.
Unexpected authentication attempts against source-control or artifact systems using credentials stored in Jenkins, appearing shortly after suspicious plugin usage.

Detection Strategies

Review Jenkins access logs for POST requests to SCM-Manager Plugin doCheck* or connection-test descriptor URLs invoked by low-privilege users.
Correlate credential usage events with the identity of the invoking user and flag mismatches against role-based access expectations.
Alert on outbound requests from the Jenkins controller to destinations not in the approved source-code-management allowlist.

Monitoring Recommendations

Forward Jenkins controller access logs, audit logs, and network egress telemetry into a centralized analytics platform for correlation.
Monitor credential-store read events and pair them with the originating user session to detect abuse of low-privilege accounts.
Establish a baseline for legitimate SCM-Manager endpoint destinations and alert on deviations.

How to Mitigate CVE-2026-70435

Immediate Actions Required

Upgrade the Jenkins SCM-Manager Plugin to a version later than 1.11.1 once a fixed release is available per the vendor advisory.
Audit Jenkins credentials that may have been reachable through the plugin and rotate any that could plausibly have been exfiltrated.
Review Jenkins user roles and remove Overall/Read from accounts that do not require it.

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3888 for the fixed version and remediation guidance from the Jenkins project.

Workarounds

Disable the Jenkins SCM-Manager Plugin until an upgrade is applied if it is not actively required.
Restrict Jenkins network egress so the controller can only reach approved source-code-management endpoints.
Apply the principle of least privilege in Jenkins authorization strategy and avoid granting anonymous or broad read access.

bash

# Example: restrict Jenkins controller egress with iptables to approved SCM hosts only
iptables -A OUTPUT -p tcp -d scm.internal.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT