CVE-2026-70437: Jenkins Webhook Auth Bypass Vulnerability

CVE-2026-70437 Overview

CVE-2026-70437 affects the Jenkins Webhook Secret Credentials Provider Plugin version 16.v0cfa_f0215cf5 and earlier. The plugin fails to use a constant-time comparison function when validating webhook bearer tokens. This weakness enables timing attacks [CWE-208], where attackers measure response time variations to progressively recover a valid bearer token. Successful exploitation exposes webhook authentication secrets that protect sensitive automation workflows in Jenkins.

Critical Impact
Attackers can apply statistical timing analysis to recover valid webhook bearer tokens, bypassing authentication on webhook endpoints protected by the affected plugin.

Affected Products

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5
Jenkins Webhook Secret Credentials Provider Plugin earlier versions

Discovery Timeline

2026-08-05 - CVE-2026-70437 published to NVD
2026-08-05 - Jenkins Security Advisory SECURITY-3918 released
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70437

Vulnerability Analysis

The Jenkins Webhook Secret Credentials Provider Plugin authenticates incoming webhook requests by comparing a provided bearer token against an expected value. Instead of using a constant-time comparison routine, the plugin relies on a comparison function that returns early on the first mismatched byte. This behavior leaks information about the correct token through response timing differences.

An attacker who can send many authenticated webhook requests and measure precise response times can apply statistical analysis to infer the token one byte at a time. Once recovered, the token grants the same access as a legitimate integration, allowing the attacker to trigger webhook actions bound to those credentials.

Root Cause

The root cause is the use of a non-constant-time equality check for secret comparison. Standard string equality operations short-circuit when characters differ, producing measurable timing variations correlated with the number of matching leading bytes. Secret-comparison logic requires functions that always process the full input length, such as MessageDigest.isEqual() in Java, to eliminate this signal.

Attack Vector

Exploitation requires network access to a Jenkins webhook endpoint served by the vulnerable plugin. The attacker submits repeated requests with candidate tokens and records response latencies. By averaging many samples per candidate, the attacker filters out network jitter and isolates the timing signal that reveals correct token bytes. The vulnerability manifests entirely in the token verification path; see the Jenkins Security Advisory #SECURITY-3918 for the vendor's technical description.

Detection Methods for CVE-2026-70437

Indicators of Compromise

High-volume webhook requests from a single source IP with authentication failures against the same endpoint.
Sustained request patterns that vary the Authorization header value across a narrow character range.
Unusual latency probing activity, including requests with abnormally short bodies targeting webhook URLs.

Detection Strategies

Inspect Jenkins access logs for repeated 401/403 responses on webhook endpoints originating from the same client over short intervals.
Correlate webhook authentication failures with successful requests that follow a burst of failures, which may indicate a recovered token.
Alert on requests where the Authorization: Bearer header value differs only in trailing bytes across successive attempts.

Monitoring Recommendations

Enable verbose logging on Jenkins webhook endpoints and forward logs to a centralized analytics platform.
Track baseline request rates per source IP for webhook URLs and alert on deviations.
Monitor plugin inventory across Jenkins controllers to identify hosts running the vulnerable version.

How to Mitigate CVE-2026-70437

Immediate Actions Required

Identify all Jenkins controllers running the Webhook Secret Credentials Provider Plugin at version 16.v0cfa_f0215cf5 or earlier.
Restrict network exposure of Jenkins webhook endpoints to trusted source ranges until a fixed version is deployed.
Rotate any webhook bearer tokens managed by the plugin after upgrading, in case tokens were already recovered.

Patch Information

Refer to the Jenkins Security Advisory #SECURITY-3918 for the vendor-recommended fixed version and upgrade instructions. Apply the update on all affected Jenkins controllers.

Workarounds

Place Jenkins webhook endpoints behind a reverse proxy or WAF that rate-limits authentication attempts per source IP.
Enforce IP allow-lists on webhook URLs so only known integration systems can reach the vulnerable code path.
Disable the plugin on controllers that do not require webhook-secret credentials until patched.

bash

# Example: rate-limit webhook authentication attempts with nginx
limit_req_zone $binary_remote_addr zone=jenkins_webhook:10m rate=5r/s;

location /jenkins/webhook/ {
    limit_req zone=jenkins_webhook burst=10 nodelay;
    proxy_pass http://jenkins_backend;
}