CVE-2026-70439: Jenkins XML Job DSL Auth Bypass Flaw

CVE-2026-70439 Overview

CVE-2026-70439 affects the Jenkins XML Job to Job DSL Plugin version 0.1.13 and earlier. The plugin fails to perform permission checks on its conversion functionality. Attackers who lack appropriate permissions can invoke the conversion feature over the network. The weakness maps to [CWE-862] Missing Authorization. Successful abuse allows unauthorized users to trigger plugin functionality intended for privileged Jenkins operators. The Jenkins project published details in Jenkins Security Advisory #SECURITY-3779.

Critical Impact
Unauthenticated network attackers can invoke the XML-to-Job-DSL conversion functionality without holding the required Jenkins permissions.

Affected Products

Jenkins XML Job to Job DSL Plugin 0.1.13
Jenkins XML Job to Job DSL Plugin versions prior to 0.1.13
Jenkins controllers running the affected plugin

Discovery Timeline

2026-08-05 - CVE-2026-70439 published to the National Vulnerability Database (NVD)
2026-08-05 - Jenkins Security Advisory SECURITY-3779 released
2026-08-05 - Last updated in the NVD database

Technical Details for CVE-2026-70439

Vulnerability Analysis

The Jenkins XML Job to Job DSL Plugin provides functionality that converts XML job configurations into Job DSL scripts. The plugin exposes this conversion capability through a Jenkins endpoint. In version 0.1.13 and earlier, the plugin does not verify that the requesting user holds the required Jenkins permissions before executing the conversion. Any authenticated or unauthenticated user with network access to the Jenkins controller can invoke the endpoint. The advisory does not indicate a fixed version, meaning administrators must apply mitigations pending a patch.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. Jenkins plugins are expected to invoke permission checks such as checkPermission() or annotate endpoints with role-based access control decorators. The XML Job to Job DSL Plugin omits this enforcement on the conversion action. As a result, the plugin trusts any inbound request without verifying the caller's identity or privileges.

Attack Vector

Attackers reach the vulnerable functionality over the network by sending crafted HTTP requests to the Jenkins controller. No user interaction is required, and the attack complexity is low. The impact is limited to confidentiality and integrity of the conversion functionality itself, with no direct availability effect. The vulnerability manifests in the plugin's request handler for the conversion feature. See the Jenkins Security Advisory #SECURITY-3779 for the vendor's technical description.

Detection Methods for CVE-2026-70439

Indicators of Compromise

Unexpected HTTP requests to Jenkins plugin endpoints associated with the XML Job to Job DSL Plugin conversion feature
Requests originating from unauthenticated sessions or user accounts without Job/Configure permissions
Elevated request volume against Jenkins controllers from unusual source IP addresses

Detection Strategies

Review Jenkins access logs for requests to plugin URLs invoking XML-to-DSL conversion actions
Correlate request source identities with the Jenkins permission model to flag callers without appropriate roles
Alert on anonymous or read-only accounts triggering plugin conversion endpoints

Monitoring Recommendations

Forward Jenkins controller access and audit logs to a centralized logging platform for retention and analysis
Baseline normal usage of the XML Job to Job DSL Plugin and alert on deviations
Monitor network traffic to Jenkins management interfaces from untrusted network segments

How to Mitigate CVE-2026-70439

Immediate Actions Required

Restrict network access to Jenkins controllers so only trusted administrators can reach management endpoints
Disable the XML Job to Job DSL Plugin if the conversion functionality is not actively required
Enforce authentication on all Jenkins endpoints and remove anonymous read access
Review recent Jenkins audit logs for unauthorized invocations of the affected plugin functionality

Patch Information

At the time of publication, the Jenkins Security Advisory SECURITY-3779 lists CVE-2026-70439 as affecting version 0.1.13 and earlier. Consult the Jenkins Security Advisory #SECURITY-3779 for the current fix status and upgrade guidance.

Workarounds

Place Jenkins controllers behind a VPN or authenticated reverse proxy to limit exposure to unauthenticated network callers
Use Jenkins' matrix-based or role-based authorization strategy to tighten default permissions
Uninstall the XML Job to Job DSL Plugin on Jenkins instances that do not require its functionality

bash

# Configuration example: disable the affected plugin via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  disable-plugin xml-job-to-job-dsl -restart