CVE-2026-70438 Overview
CVE-2026-70438 is a missing permission check in the Jenkins Parameterized Remote Trigger Plugin version 3.2.2 and earlier. The plugin fails to enforce proper authorization on an endpoint that returns credential identifiers. Attackers holding only Overall/Read permission can enumerate credential IDs stored inside Jenkins.
Enumerated credential IDs do not directly reveal secret values. However, they provide reconnaissance that supports follow-on attacks that abuse other credential-related vulnerabilities or misconfigurations in the Jenkins environment.
Critical Impact
Low-privileged Jenkins users can enumerate credential IDs, exposing reconnaissance data that supports credential theft chains.
Affected Products
- Jenkins Parameterized Remote Trigger Plugin 3.2.2
- Jenkins Parameterized Remote Trigger Plugin, all earlier versions
- Jenkins controllers with the affected plugin installed
Discovery Timeline
- 2026-08-05 - Jenkins publishes Security Advisory SECURITY-3768
- 2026-08-05 - CVE-2026-70438 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70438
Vulnerability Analysis
The Jenkins Parameterized Remote Trigger Plugin exposes a form-related HTTP endpoint that returns a list of credential IDs available for selection when configuring a remote trigger step. In affected versions, this endpoint does not verify that the requesting user holds a permission appropriate for viewing credential metadata.
A user with Overall/Read — the minimum permission required to authenticate against Jenkins — can invoke the endpoint directly. The server responds with the credential IDs of credentials stored in the Jenkins instance, including credentials scoped to jobs or folders the user cannot otherwise view.
The issue is classified as broken access control. It does not disclose secret values, tokens, or passwords, but it does leak identifiers that map to those secrets.
Root Cause
The root cause is a missing authorization check inside the plugin's HTTP endpoint handler. Jenkins plugins are expected to invoke a permission check such as checkPermission(CredentialsProvider.VIEW) before returning credential-related data. The affected handler omits this check and processes anonymous or low-privileged requests as if they were authorized.
Attack Vector
An authenticated attacker with Overall/Read sends a crafted HTTP request to the plugin's credentials enumeration endpoint on the Jenkins controller. The response contains credential IDs that the attacker uses to target follow-on attacks — for example, chaining with credential-dumping vulnerabilities, referencing credentials from attacker-controlled jobs, or performing brute-force attacks against known credential names.
See the Jenkins Security Advisory 2026-08-05 (SECURITY-3768) for the vendor's technical description.
Detection Methods for CVE-2026-70438
Indicators of Compromise
- HTTP requests from low-privileged accounts to plugin descriptor endpoints under /descriptorByName/org.jenkinsci.plugins.ParameterizedRemoteTrigger returning credential identifiers.
- Unexpected read-only user accounts issuing fillCredentialsIdItems or similar doFill* requests against the Jenkins controller.
- Access-log spikes for the Parameterized Remote Trigger Plugin endpoints originating from accounts that do not own or configure jobs.
Detection Strategies
- Review the Jenkins access.log for requests to plugin form-completion endpoints made by users without job configuration rights.
- Alert on Overall/Read-only users generating requests to any doFill* endpoint on plugin descriptors.
- Correlate credential ID enumeration attempts with subsequent job creation or configuration activity by the same principal.
Monitoring Recommendations
- Ingest Jenkins controller access logs and audit logs into a centralized log platform for behavioral analysis.
- Baseline expected callers of plugin descriptor endpoints, then alert on deviations.
- Track the installed version of the Parameterized Remote Trigger Plugin across all Jenkins controllers to identify unpatched instances.
How to Mitigate CVE-2026-70438
Immediate Actions Required
- Inventory all Jenkins controllers and identify instances running Parameterized Remote Trigger Plugin 3.2.2 or earlier.
- Update the plugin to a fixed version published in the Jenkins Security Advisory 2026-08-05.
- Audit which users hold Overall/Read and remove the permission from accounts that do not require it.
- Rotate any credentials whose IDs may have been exposed to untrusted users.
Patch Information
Apply the fixed release of the Parameterized Remote Trigger Plugin as documented in the Jenkins Security Advisory. The advisory lists the minimum plugin version that includes the missing permission check. Restart the Jenkins controller after installation if required by the plugin update.
Workarounds
- Restrict anonymous and unauthenticated access to Jenkins, and enforce authentication for all users.
- Apply the principle of least privilege by limiting Overall/Read grants and using project-based matrix authorization.
- Place Jenkins controllers behind an authenticated reverse proxy to block unauthorized network access to plugin endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
