CVE-2026-70443: Jenkins Horreum Auth Bypass Vulnerability

CVE-2026-70443 Overview

CVE-2026-70443 affects the Jenkins Horreum Plugin version 0.16.162.v33b_4a_a_b_5f828 and earlier. The plugin fails to set the appropriate context for credentials lookup during Horreum integration operations. Attackers holding Item/Configure permission can leverage this flaw to make Jenkins transmit credentials they are not entitled to use to the administrator-configured Horreum URL. The issue is classified as improper privilege management [CWE-269] and requires an authenticated attacker on the Jenkins instance.

Critical Impact
Authenticated users with Item/Configure permission can force Jenkins to send arbitrary stored credentials to the configured Horreum endpoint, enabling credential disclosure across authorization boundaries.

Affected Products

Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier
Jenkins controllers with the Horreum Plugin installed and configured
Jenkins environments that store credentials scoped outside the requesting job's context

Discovery Timeline

2026-08-05 - Jenkins Security Advisory SECURITY-3756 published
2026-08-05 - CVE-2026-70443 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70443

Vulnerability Analysis

The Jenkins Horreum Plugin integrates Jenkins jobs with the Horreum performance regression database. Credential lookups performed by Jenkins plugins must specify a context, typically the item (job) requesting the credential, so that Jenkins can enforce access control. The Horreum Plugin does not scope credential lookups to the correct context. As a result, Jenkins resolves any credential ID supplied by a job configurer without verifying whether the configuring user has authorization to use that credential.

An attacker with Item/Configure permission on any job can enumerate or specify credential IDs, then trigger a build. Jenkins retrieves the requested credential and transmits it to the Horreum URL the administrator configured. This crosses trust boundaries because the credentials may belong to higher-privilege scopes such as the global store or folders the attacker cannot otherwise access.

Root Cause

The root cause is missing or incorrect credential context binding during the credentials lookup call in the plugin. Jenkins plugins must pass the item context to the credentials provider so that per-item authorization checks apply. The Horreum Plugin omits or misconfigures this context, causing Jenkins to treat the lookup as global and return credentials the requesting user should not access.

Attack Vector

Exploitation requires network access to the Jenkins web interface and an account with Item/Configure permission on at least one job. The attacker edits a job configuration, references a credential ID for a credential they should not have access to, and executes the job. The Horreum Plugin then transmits the resolved credential to the administrator-configured Horreum URL. If the attacker controls or observes traffic to that URL, or if the URL is a system they can otherwise inspect, they recover the credential value. No user interaction outside the attacker is required.

// No verified proof-of-concept code is published for this issue.
// Refer to the Jenkins Security Advisory SECURITY-3756 for technical details.

Detection Methods for CVE-2026-70443

Indicators of Compromise

Unexpected outbound requests from Jenkins controllers to the configured Horreum URL that correlate with recently edited job configurations.
Jenkins audit log entries showing Item/Configure actions followed by builds referencing credential IDs outside the job's expected scope.
Modifications to job configurations by non-administrator users that add or change Horreum credential references.

Detection Strategies

Review the Jenkins system log and job configuration history for changes to Horreum-related credential IDs made by non-administrator accounts.
Correlate config.xml diffs across jobs to identify credential IDs assigned to jobs by users lacking usage authorization.
Inspect Horreum server access logs for authentication events whose credentials do not match the expected job owner.

Monitoring Recommendations

Alert on Jenkins job configuration changes performed by users with only Item/Configure permission when those changes touch credential bindings.
Monitor outbound traffic from Jenkins controllers to the Horreum endpoint for anomalies in volume or credential material.
Track plugin version inventory across Jenkins controllers and flag any controller running Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 or earlier.

How to Mitigate CVE-2026-70443

Immediate Actions Required

Update the Jenkins Horreum Plugin to the version released in the Jenkins security advisory dated 2026-08-05.
Audit all Jenkins jobs that reference Horreum credentials and remove references configured by non-administrator users.
Rotate any credentials that were referenced by Horreum-integrated jobs and could have been transmitted to the configured Horreum URL.

Patch Information

Jenkins published fix details in Jenkins Security Advisory #SECURITY-3756. Administrators should upgrade the Horreum Plugin to the fixed version referenced in that advisory. Restart the Jenkins controller after upgrade to ensure the updated plugin class loader is active.

Workarounds

Restrict Item/Configure permission to trusted users until the plugin is upgraded.
Disable or uninstall the Horreum Plugin on controllers where the Horreum integration is not required.
Store Horreum credentials in a folder scope that limits access to jobs and users authorized to use them, reducing exposure if the plugin is exploited.

bash

# List Jenkins controllers running vulnerable Horreum Plugin versions
# via the Jenkins CLI (requires appropriate admin authentication)
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i horreum