CVE-2026-70447 Overview
CVE-2026-70447 is a missing authorization vulnerability in the Jenkins AWS CodeBuild Plugin version 0.59 and earlier. The plugin fails to enforce permission checks on an endpoint used to list credentials. Attackers with Overall/Read permission can enumerate credentials IDs of credentials stored in Jenkins. The weakness is classified as [CWE-862] Missing Authorization. Exploitation does not disclose the credential secrets, but the enumerated IDs support follow-on attacks that reference them by identifier. The Jenkins project disclosed the issue in its security advisory published on 2026-08-05.
Critical Impact
Authenticated users with minimal Overall/Read permission can enumerate Jenkins credential IDs, enabling reconnaissance for chained attacks against CI/CD secrets.
Affected Products
- Jenkins AWS CodeBuild Plugin version 0.59
- Jenkins AWS CodeBuild Plugin versions earlier than 0.59
- Jenkins controllers with the AWS CodeBuild Plugin installed
Discovery Timeline
- 2026-08-05 - Jenkins publishes security advisory SECURITY-3773
- 2026-08-05 - CVE-2026-70447 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70447
Vulnerability Analysis
The Jenkins AWS CodeBuild Plugin exposes functionality that returns identifiers for credentials stored in the Jenkins credentials store. In versions 0.59 and earlier, the affected endpoint does not verify that the requesting user holds sufficient permissions before returning results. Any authenticated user with Overall/Read — the baseline permission granted to most Jenkins users — can invoke it. The result is disclosure of credential IDs across the instance, which reveals the naming, structure, and scope of secrets configured for AWS CodeBuild integration.
Root Cause
The root cause is a missing permission check [CWE-862] on a plugin endpoint that lists credentials. Jenkins guidance requires that endpoints returning credential metadata enforce CredentialsProvider.hasPermission() checks against the appropriate context. The AWS CodeBuild Plugin omitted these checks, allowing low-privilege authenticated users to reach the enumeration path.
Attack Vector
Exploitation requires network access to the Jenkins web interface and a valid account with Overall/Read permission. The attacker issues an authenticated HTTP request to the vulnerable plugin endpoint. The server returns credential IDs without further authorization. No user interaction is required, and attack complexity is low. The vulnerability does not directly expose secret material, but enumerated IDs are used in Jenkinsfile references and Groovy scripts, so they aid subsequent attacks against pipelines or misconfigured jobs.
No verified proof-of-concept code is published. See the Jenkins Security Advisory 2026-08-05 for the vendor's technical description.
Detection Methods for CVE-2026-70447
Indicators of Compromise
- Authenticated HTTP requests from low-privilege user accounts to AWS CodeBuild Plugin descriptor URLs under /descriptorByName/ or job configuration paths that return credentials metadata.
- Unusual volume of credential-listing requests originating from a single Jenkins user session or API token.
- Access to plugin endpoints from accounts that do not own or configure pipelines using AWS CodeBuild.
Detection Strategies
- Review Jenkins access logs for requests to AWS CodeBuild Plugin endpoints made by users lacking configure permissions on relevant jobs or folders.
- Correlate Overall/Read-only accounts with requests that return credential identifiers, which is anomalous for that permission tier.
- Enable Jenkins audit logging via the Audit Trail plugin and alert on programmatic scraping patterns against plugin endpoints.
Monitoring Recommendations
- Ingest Jenkins controller access logs into a central SIEM and baseline normal endpoint usage per user role.
- Track creation of new API tokens on low-privilege accounts and monitor their subsequent HTTP activity against plugin URLs.
- Alert on any use of enumerated credential IDs in newly created or modified Jenkinsfiles and pipeline scripts.
How to Mitigate CVE-2026-70447
Immediate Actions Required
- Upgrade the Jenkins AWS CodeBuild Plugin to a version later than 0.59 once the maintainers publish a fixed release, as referenced in the Jenkins advisory.
- Audit user assignments and remove Overall/Read from accounts that do not require it.
- Rotate AWS credentials stored in Jenkins if logs indicate enumeration by untrusted accounts.
Patch Information
Refer to the Jenkins Security Advisory 2026-08-05 for the authoritative fix status and upgrade guidance for SECURITY-3773. At publication time, the advisory tracks the issue against AWS CodeBuild Plugin 0.59 and earlier.
Workarounds
- Restrict access to the Jenkins controller through network controls so only trusted users reach the web interface.
- Apply the Matrix Authorization Strategy to limit Overall/Read to accounts with a documented need.
- Disable or uninstall the AWS CodeBuild Plugin on controllers where it is not actively used until a patched version is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
