CVE-2026-70446: Jenkins CodeSonar Information Disclosure

CVE-2026-70446 Overview

CVE-2026-70446 is a missing authorization vulnerability in the Jenkins CodeSonar Plugin version 3.6.0 and earlier. The plugin fails to enforce proper permission checks on a form validation endpoint. Attackers holding only Overall/Read permission can enumerate credential IDs of credentials stored in Jenkins. This weakness maps to [CWE-862: Missing Authorization]. While the flaw does not directly expose credential secrets, enumerated credential IDs can support follow-on attacks that combine with other Jenkins vulnerabilities to retrieve credential material.

Critical Impact
Authenticated users with minimal read privileges can enumerate stored credential IDs, expanding the attack surface for credential theft chains in Jenkins environments.

Affected Products

Jenkins CodeSonar Plugin 3.6.0 and earlier

Discovery Timeline

2026-08-05 - Jenkins Security Advisory SECURITY-3772 published
2026-08-05 - CVE-2026-70446 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70446

Vulnerability Analysis

The Jenkins CodeSonar Plugin exposes functionality that lists credential IDs available to Jenkins jobs. In vulnerable versions, the endpoint responsible for populating credential selection controls does not verify that the requesting user has sufficient permissions to view job configurations or credential metadata.

As a result, any authenticated user with Overall/Read permission, which is often the baseline permission for any Jenkins account, can invoke the endpoint. The plugin then returns credential IDs from the Jenkins credentials store to the caller. Credential IDs are metadata identifiers, not the secret material itself, but they enable targeted reconnaissance of the Jenkins secret inventory.

Root Cause

The root cause is a missing permission check in the plugin's form validation method. Jenkins plugins are expected to call checkPermission() or equivalent guards before exposing configuration data. The affected CodeSonar Plugin methods omit these guards, allowing low-privilege callers to reach credential enumeration logic that should be restricted to users with configuration permissions on the relevant item or credentials scope.

Attack Vector

Exploitation requires network access to the Jenkins controller and a valid account with Overall/Read permission. The attacker sends a crafted HTTP request to the plugin's form validation URL. The controller responds with the list of credential IDs available in the target scope. The attacker then correlates these identifiers with known integrations and uses them in subsequent chained attacks against other plugin vulnerabilities that expose credential contents by ID.

No exploitation code example is published in the advisory. See the Jenkins Security Advisory #SECURITY-3772 for technical details.

Detection Methods for CVE-2026-70446

Indicators of Compromise

Unexpected HTTP requests from low-privilege user accounts to Jenkins plugin form validation endpoints under /descriptorByName/ paths associated with the CodeSonar Plugin.
Repeated enumeration-style requests to credential selection endpoints originating from a single session or IP.
User agents or session tokens tied to Overall/Read-only accounts accessing configuration-adjacent URLs.

Detection Strategies

Inspect Jenkins access logs for requests to CodeSonar Plugin descriptor endpoints correlated with users lacking job configuration rights.
Alert on anomalous request volumes to fillCredentialsIdItems-style endpoints across any installed plugin.
Review Jenkins audit logs for read-only accounts issuing requests that return credential metadata.

Monitoring Recommendations

Forward Jenkins controller access and audit logs to a centralized log platform for retention and correlation.
Baseline normal traffic patterns for form validation endpoints and flag deviations tied to non-privileged principals.
Track plugin version inventory across Jenkins controllers to identify hosts still running CodeSonar Plugin 3.6.0 or earlier.

How to Mitigate CVE-2026-70446

Immediate Actions Required

Identify all Jenkins controllers running the CodeSonar Plugin and record installed versions.
Restrict Overall/Read permission to trusted users until a fixed plugin release is deployed.
Rotate any credentials whose IDs may have been exposed to untrusted authenticated users.

Patch Information

Refer to the Jenkins Security Advisory #SECURITY-3772 for the fixed plugin version and upgrade instructions. Apply the vendor-supplied update to the CodeSonar Plugin on all Jenkins controllers where it is installed.

Workarounds

Disable or uninstall the CodeSonar Plugin on controllers where it is not required.
Enforce matrix-based or role-based authorization strategies that limit Overall/Read to a small set of accounts.
Segment Jenkins controllers from untrusted networks and require multi-factor authentication for all Jenkins accounts.

bash

# Configuration example: list installed plugin versions via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth @credentials.txt \
  list-plugins | grep -i codesonar