CVE-2026-70442: Jenkins Google Chat Plugin Auth Bypass

CVE-2026-70442 Overview

CVE-2026-70442 affects the Jenkins Google Chat Notification Plugin version 166.ve6b_de280f2e8 and earlier. The plugin fails to set the appropriate context for credentials lookup during configuration operations. Attackers holding Item/Configure permission can access and capture credentials stored in Jenkins that they are not entitled to use. This weakness maps to improper authorization [CWE-285] and enables credential disclosure across project boundaries in shared Jenkins environments.

Critical Impact
Authenticated Jenkins users with Item/Configure permission can enumerate and exfiltrate credentials outside their authorized scope, exposing secrets used by other pipelines and jobs.

Affected Products

Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8
Jenkins Google Chat Notification Plugin versions earlier than 166.ve6b_de280f2e8
Jenkins controllers with the affected plugin installed and multi-tenant job configuration

Discovery Timeline

2026-08-05 - CVE CVE-2026-70442 published to NVD
2026-08-05 - Jenkins Security Advisory SECURITY-3752 released
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70442

Vulnerability Analysis

The Jenkins Google Chat Notification Plugin performs credentials lookup when users configure notification targets on jobs and pipelines. The plugin does not scope this lookup to the requesting item's authorization context. As a result, the lookup executes with elevated visibility across the Jenkins credentials store rather than being restricted to credentials the configuring user can legitimately use.

An attacker with Item/Configure permission on any job can invoke the plugin's configuration endpoints. The plugin returns credential identifiers and, through subsequent build or test operations, can reveal secret values by binding them into notification requests. This bypasses the credential isolation model Jenkins enforces between projects, folders, and users.

The issue is characteristic of missing authorization checks in Jenkins plugins that consume the credentials-plugin API without passing the correct Item or Authentication context. Similar patterns have appeared across multiple Jenkins plugins historically.

Root Cause

The plugin invokes credentials lookup APIs without providing the correct authentication and item context. Jenkins uses this context to filter which credentials a caller may enumerate. Passing a null or global context returns credentials the requesting user should not see.

Attack Vector

Exploitation requires a valid Jenkins account with Item/Configure permission. The attacker opens the configuration page of a job they control, adds or edits the Google Chat notification step, and triggers credential enumeration. Captured credential IDs are then referenced in a build step to exfiltrate their values through the attacker's controlled notification endpoint or build output.

Refer to the Jenkins Security Advisory SECURITY-3752 for the vendor's technical description.

Detection Methods for CVE-2026-70442

Indicators of Compromise

Unexpected modifications to job configurations that add or edit Google Chat notification steps by users with only Item/Configure permission.
Build logs referencing credential IDs that do not belong to the job's owning folder or team.
Outbound HTTPS requests from Jenkins agents to Google Chat webhook URLs that were not previously configured.
Audit log entries showing credential lookup calls originating from the Google Chat Notification Plugin outside expected build contexts.

Detection Strategies

Review Jenkins audit logs for config.xml changes on jobs that add GoogleChatNotification publisher entries.
Correlate Item/Configure actions with subsequent credential binding usage across jobs owned by different teams.
Alert on any job that references a credential ID scoped to a folder the job does not belong to.

Monitoring Recommendations

Enable and forward Jenkins system and audit logs to a centralized SIEM for correlation.
Baseline the set of credential IDs referenced per folder and flag deviations.
Monitor egress from Jenkins controllers and agents to chat.googleapis.com and other webhook destinations.

How to Mitigate CVE-2026-70442

Immediate Actions Required

Upgrade the Jenkins Google Chat Notification Plugin to a version later than 166.ve6b_de280f2e8 once released by the maintainer.
Restrict Item/Configure permission to trusted users until the plugin is upgraded.
Rotate credentials that may have been exposed to users with Item/Configure permission on Jenkins jobs using this plugin.
Audit existing jobs for unauthorized Google Chat notification configurations.

Patch Information

Consult the Jenkins Security Advisory SECURITY-3752 for the fixed version and upgrade instructions. At the time of publication, the advisory identifies 166.ve6b_de280f2e8 and earlier as affected.

Workarounds

Disable the Google Chat Notification Plugin until a fixed version is installed.
Scope credentials to specific folders using the Folder Credentials Provider to reduce the blast radius.
Remove Item/Configure from users who do not require it, granting Item/Build or Item/Read instead.
Use per-job or per-folder credential stores rather than global credentials for sensitive secrets.

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep google-chat-notification

# Upgrade to the fixed version once available
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin google-chat-notification -deploy