CVE-2026-70436: Jenkins External Workspace Manager Bypass

CVE-2026-70436 Overview

CVE-2026-70436 affects the Jenkins External Workspace Manager Plugin, versions 1.4.1 and earlier. The plugin fails to perform a permission check in versions 1.4.0 and earlier, and performs an improper permission check in version 1.4.1, when serving externally-managed workspaces through the workspace browser. Attackers with Overall/Read permission can read files in workspaces they are not authorized to access. The flaw is a broken access control issue [CWE-284] tracked as SECURITY-3907 in the Jenkins Security Advisory 2026-08-05.

Critical Impact
Authenticated users with minimal Jenkins permissions can read arbitrary files in externally-managed workspaces, exposing source code, build artifacts, and secrets stored on shared infrastructure.

Affected Products

Jenkins External Workspace Manager Plugin 1.4.0 and earlier (no permission check)
Jenkins External Workspace Manager Plugin 1.4.1 (improper permission check)
Jenkins controllers that expose the workspace browser to authenticated users

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory 2026-08-05 (SECURITY-3907)
2026-08-05 - CVE-2026-70436 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70436

Vulnerability Analysis

The Jenkins External Workspace Manager Plugin lets pipelines share workspaces across nodes by pointing to externally-managed storage such as network file systems. The workspace browser exposes these workspaces through the Jenkins web UI. Versions 1.4.0 and earlier serve workspace contents without checking whether the requesting user has permission on the associated job. Version 1.4.1 introduced a permission check, but the check is incomplete and can be bypassed. Any user granted the baseline Overall/Read permission can enumerate and read files in workspaces belonging to jobs they cannot otherwise view.

The exposed data commonly includes source code checked out during builds, compiled artifacts, test outputs, and configuration files. In many CI environments these workspaces also contain credentials, private keys, and tokens injected at build time. Because the plugin serves externally-managed paths, one Jenkins instance may leak content owned by other teams sharing the same storage.

Root Cause

The root cause is missing and then improperly implemented authorization on the workspace browser endpoint. The plugin does not consistently validate that the authenticated principal holds Item/Workspace or equivalent job-level permission before returning file contents from externally-managed locations.

Attack Vector

An attacker authenticates to Jenkins with any account holding Overall/Read. The attacker then requests workspace browser URLs referencing jobs configured to use the External Workspace Manager Plugin. The controller returns file contents without enforcing job-level authorization. See the Jenkins Security Advisory 2026-08-05 for the full technical description.

Detection Methods for CVE-2026-70436

Indicators of Compromise

Requests to workspace browser URLs under /plugin/external-workspace-manager/ or job-scoped ws/ paths from accounts that lack read access to the target job.
HTTP 200 responses returning file listings or file contents to low-privilege users in Jenkins access logs.
Unusual volume of workspace enumeration from a single authenticated session across multiple job names.

Detection Strategies

Correlate Jenkins access logs with the authorization matrix and flag successful workspace browser reads by users without Item/Read on the target job.
Inventory installed plugin versions across Jenkins controllers and alert on External Workspace Manager Plugin at or below 1.4.1.
Review audit logs for the Audit Trail plugin or reverse-proxy logs to identify workspace access patterns inconsistent with a user's assigned projects.

Monitoring Recommendations

Forward Jenkins controller logs to a centralized log platform and build detections for workspace browser requests scoped by user role.
Monitor for post-authentication access to sensitive files such as credentials.xml, .git/config, id_rsa, and .env inside workspace responses.
Track plugin version drift on Jenkins controllers as part of routine vulnerability management.

How to Mitigate CVE-2026-70436

Immediate Actions Required

Upgrade the Jenkins External Workspace Manager Plugin to a fixed version as identified in the Jenkins Security Advisory 2026-08-05.
Restrict Overall/Read to trusted users until the plugin is upgraded, and audit existing role assignments.
Rotate any credentials, tokens, or keys that may have been present in externally-managed workspaces.

Patch Information

Refer to the Jenkins Security Advisory 2026-08-05 (SECURITY-3907) for the fixed plugin version and upgrade guidance. Apply the plugin update through the Jenkins Update Center and restart the controller to load the corrected authorization checks.

Workarounds

Uninstall or disable the External Workspace Manager Plugin if it is not required for active pipelines.
Remove externally-managed workspace configurations and revert affected jobs to use the default per-node workspaces until patching is complete.
Place Jenkins behind an authenticating reverse proxy that enforces additional access control on /job/*/ws/ and plugin routes.

bash

# Configuration example
# List installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  list-plugins | grep external-workspace-manager

# Disable the plugin pending upgrade
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  disable-plugin external-workspace-manager -restart