CVE-2026-70445: Jenkins Sauce OnDemand Info Disclosure

CVE-2026-70445 Overview

CVE-2026-70445 affects the Jenkins Sauce OnDemand Plugin version 2.2.0 and earlier. The plugin fails to enforce proper permission checks on a form validation endpoint. Attackers holding only Overall/Read permission can enumerate credentials IDs stored within Jenkins. This information disclosure weakness reduces the effort required to plan follow-on attacks against sensitive credentials managed by the Jenkins controller. The issue is documented in the Jenkins Security Advisory #SECURITY-3770.

Critical Impact
Any authenticated Jenkins user with baseline read access can enumerate credentials IDs, providing reconnaissance data useful for chaining with other credential-targeting vulnerabilities.

Affected Products

Jenkins Sauce OnDemand Plugin 2.2.0
Jenkins Sauce OnDemand Plugin versions earlier than 2.2.0
Jenkins controllers with the Sauce OnDemand Plugin installed

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3770
2026-08-05 - CVE-2026-70445 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70445

Vulnerability Analysis

The Sauce OnDemand Plugin exposes a form validation endpoint used by the Jenkins configuration UI. This endpoint accepts a credentials identifier parameter and returns validation feedback. In vulnerable releases, the endpoint does not verify that the requesting user holds administrative or job-level configuration permissions before returning data. Any authenticated user with Overall/Read permission can invoke the endpoint. By iterating requests or observing responses, an attacker can enumerate the credentials IDs stored in Jenkins credential providers. This class of weakness is a missing authorization check on an HTTP endpoint that indirectly exposes internal identifiers.

Root Cause

The root cause is a missing permission check on a plugin-provided form validation method. Jenkins plugins are expected to gate credential-related endpoints behind Item/Configure, Item/Extended Read, or equivalent permissions. The Sauce OnDemand Plugin omits the checkPermission call and does not require a POST request, so users with only baseline read access can reach the handler. The endpoint then interacts with the credentials subsystem in a way that discloses whether specific credentials IDs exist.

Attack Vector

Exploitation requires an authenticated Jenkins session with Overall/Read permission. The attacker issues HTTP requests to the plugin's form validation URL, supplying candidate credentials IDs or observing responses that enumerate stored IDs. No user interaction beyond the attacker's own requests is required. The exposed credentials IDs do not include secret material directly, but they enable targeted attacks against specific credentials if a secondary vulnerability or misconfiguration is present. Refer to the Jenkins Security Advisory #SECURITY-3770 for endpoint-level details.

Detection Methods for CVE-2026-70445

Indicators of Compromise

Unexpected HTTP requests from low-privilege Jenkins accounts to Sauce OnDemand Plugin descriptor URLs containing doCheck or doFill handlers.
Access log entries showing repeated form-validation requests referencing credentials parameters from non-administrator users.
Correlated activity where enumeration is followed by attempts to use disclosed credentials IDs in job configuration or API calls.

Detection Strategies

Review Jenkins access logs for requests to /descriptorByName/hudson.plugins.sauce_ondemand.* endpoints originating from users without Item/Configure rights.
Alert on high-volume validation endpoint requests from a single authenticated session, which suggests automated enumeration.
Baseline normal plugin endpoint usage per role and flag deviations by users with only Overall/Read permission.

Monitoring Recommendations

Forward Jenkins controller access logs to a centralized log platform for retention and correlation with identity events.
Track user permission grants and monitor accounts limited to Overall/Read for anomalous API interactions.
Monitor plugin inventory and version data to identify controllers still running Sauce OnDemand Plugin 2.2.0 or earlier.

How to Mitigate CVE-2026-70445

Immediate Actions Required

Identify all Jenkins controllers with the Sauce OnDemand Plugin installed and confirm the installed version.
Upgrade the Sauce OnDemand Plugin to a fixed release as documented in the Jenkins Security Advisory #SECURITY-3770.
Audit users granted Overall/Read permission and remove access for accounts that do not require it.
Rotate credentials stored in Jenkins if enumeration activity is suspected in access logs.

Patch Information

The Jenkins project addresses CVE-2026-70445 in a Sauce OnDemand Plugin release published alongside the August 5, 2026 security advisory. Administrators should apply the plugin update through the Jenkins Update Center. Consult the Jenkins Security Advisory #SECURITY-3770 for the specific fixed version and upgrade guidance.

Workarounds

Restrict Overall/Read permission to trusted users until the plugin can be upgraded.
Disable the Sauce OnDemand Plugin on controllers where it is not actively used.
Enforce Matrix or Role-Based authorization to segment access to job configuration and credential-related endpoints.

bash

# Example: list installed Jenkins plugins and versions via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  list-plugins | grep -i sauce-ondemand

# Example: upgrade the plugin from the Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  install-plugin sauce-ondemand -deploy