CVE-2026-70440: Jenkins Qualys Plugin XSS Vulnerability

CVE-2026-70440 Overview

CVE-2026-70440 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Qualys Container Scanning Connector Plugin. Versions 1.8.0.5 and earlier fail to escape user-controlled field values rendered in a JavaScript context. Attackers with Item/Configure permission can inject persistent JavaScript payloads that execute in the browsers of other Jenkins users. The flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation can lead to session theft, unauthorized job configuration changes, and lateral movement within the Jenkins environment.

Critical Impact
Authenticated attackers with Item/Configure permission can execute arbitrary JavaScript in the context of other Jenkins users, enabling session hijacking and privilege abuse.

Affected Products

Jenkins Qualys Container Scanning Connector Plugin versions 1.8.0.5 and earlier
Jenkins controllers configured with the vulnerable plugin
Jenkins environments granting Item/Configure permissions to untrusted users

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3749
2026-08-05 - CVE-2026-70440 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70440

Vulnerability Analysis

The Jenkins Qualys Container Scanning Connector Plugin renders user-controlled configuration values inside a JavaScript context without proper escaping. When an attacker supplies input containing JavaScript metacharacters, those characters break out of the intended string context and become executable code. The payload is stored in the Jenkins job configuration and executes each time another user views or interacts with the affected page. This turns the plugin's configuration UI into a delivery mechanism for persistent script injection against administrators and other privileged users.

Root Cause

The root cause is missing output encoding for user-controlled field values that the plugin embeds inside <script> blocks or inline event handlers. Jenkins provides escaping utilities for JavaScript contexts, but the affected code paths in the Qualys Container Scanning Connector Plugin did not apply them. Any string containing quotes, backslashes, or angle brackets can terminate the intended literal and inject arbitrary script.

Attack Vector

Exploitation requires authenticated access with Item/Configure permission on a Jenkins instance running the vulnerable plugin. The attacker modifies a job configuration field consumed by the plugin, embedding a JavaScript payload. When a victim, typically an administrator, later loads the job configuration or a related page, the payload executes in the victim's browser session. User interaction (UI:R) is required to trigger execution. The scope change (S:C) reflects that the injected script runs in the trust context of the Jenkins web application, allowing the attacker to act as the victim.

No verified public proof-of-concept is available. See the Jenkins Security Advisory SECURITY-3749 for authoritative technical details.

Detection Methods for CVE-2026-70440

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript keywords stored in Qualys Container Scanning Connector Plugin configuration fields
Jenkins job configuration changes made by users holding Item/Configure but not Overall/Administer permission
Anomalous outbound HTTP requests originating from Jenkins user browsers to attacker-controlled domains after visiting job pages

Detection Strategies

Audit Jenkins config.xml files for the Qualys Container Scanning Connector Plugin and scan stored field values for HTML or JavaScript metacharacters
Review Jenkins audit logs for recent Item/Configure actions performed against jobs using the vulnerable plugin
Deploy Content Security Policy (CSP) reporting on the Jenkins frontend to surface script execution violations

Monitoring Recommendations

Alert on modifications to Jenkins job configurations that introduce script-related tokens such as <script, javascript:, or onerror=
Monitor browser telemetry from administrator workstations for unexpected script execution originating from the Jenkins domain
Track plugin inventory across Jenkins controllers to identify hosts still running Qualys Container Scanning Connector Plugin 1.8.0.5 or earlier

How to Mitigate CVE-2026-70440

Immediate Actions Required

Identify all Jenkins controllers running the Qualys Container Scanning Connector Plugin and record their versions
Restrict Item/Configure permission to trusted users until a patched plugin version is deployed
Review recent job configuration changes for injected script content and revert suspicious modifications

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3749 for the fixed plugin version and upgrade guidance. Apply the vendor-supplied update on every affected Jenkins controller and validate that stored configuration fields render as inert text after the upgrade.

Workarounds

Limit Item/Configure permission to a minimal set of trusted administrators through Jenkins role-based access control
Disable the Qualys Container Scanning Connector Plugin if it is not required for active pipelines
Enforce a strict Content Security Policy on the Jenkins web interface to reduce the impact of injected scripts

bash

# Example: list Jenkins plugins and versions to locate vulnerable instances
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="qualys-container-scanning-connector") | {shortName, version, active}'