CVE-2026-70448: Jenkins Ivy Report Plugin XXE Vulnerability

CVE-2026-70448 Overview

CVE-2026-70448 is an XML External Entity (XXE) vulnerability in the Jenkins Ivy Report Plugin version 1.2 and earlier. The plugin fails to configure its XML parser with secure defaults when processing Ivy report files. Authenticated attackers with sufficient permissions can supply crafted Ivy report files that reference external entities. The XML parser resolves those entities and returns their content or triggers server-side requests.

The issue is classified as [CWE-611] Improper Restriction of XML External Entity Reference. It affects Jenkins environments that use the Ivy Report Plugin as part of their build pipelines.

Critical Impact
Attackers can read sensitive files from the Jenkins controller and reach internal network resources through server-side request forgery via XXE.

Affected Products

Jenkins Ivy Report Plugin version 1.2
Jenkins Ivy Report Plugin versions earlier than 1.2
Jenkins controllers running the vulnerable plugin

Discovery Timeline

2026-08-05 - CVE CVE-2026-70448 published to NVD
2026-08-05 - Jenkins Security Advisory SECURITY-3899 released
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70448

Vulnerability Analysis

The Ivy Report Plugin parses Ivy report XML files generated during builds. The parser is instantiated without disabling external entity resolution or DTD processing. When the plugin ingests a report file containing a <!DOCTYPE> declaration with an external entity, the parser dereferences that entity during parsing.

Attackers craft an Ivy report referencing a local file such as /etc/passwd or a network URL. The parser reads the referenced resource and inlines its content into the parsed document. That content can then be surfaced through build output or plugin views. The vulnerability requires authenticated access with permissions to influence build inputs, which aligns with the CVSS attack vector requiring low privileges over the network.

Root Cause

The root cause is missing hardening on the XML parser factory used by the plugin. Secure XML parsing requires disabling features such as http://apache.org/xml/features/disallow-doctype-decl, external-general-entities, and external-parameter-entities. Without these settings, the parser follows the XML 1.0 specification and resolves entities as declared.

Attack Vector

An authenticated user with permission to configure or trigger builds supplies a malicious Ivy report file. The file contains a DTD with an external entity that points at a local file path or an internal HTTP endpoint. When the plugin renders the report, the parser resolves the entity and exposes its contents. The vulnerability manifests in the plugin's XML parsing routines for Ivy report files. See the Jenkins Security Advisory #SECURITY-3899 for technical details.

Detection Methods for CVE-2026-70448

Indicators of Compromise

Ivy report files containing <!DOCTYPE> declarations or <!ENTITY> references in Jenkins workspaces
Outbound HTTP requests from the Jenkins controller to unexpected internal or external hosts during Ivy report processing
Jenkins controller reads of sensitive files such as /etc/passwd, /etc/shadow, or Jenkins secrets directories correlated with build activity
Build logs containing file contents unrelated to Ivy dependencies

Detection Strategies

Inspect Ivy report XML artifacts for DTD declarations and external entity references before parsing
Correlate Jenkins build events with process-level file access telemetry on the Jenkins controller
Alert on Jenkins JVM processes issuing DNS or HTTP requests to hosts outside the expected build dependency mirrors

Monitoring Recommendations

Enable Jenkins audit logging for job configuration changes and build parameter modifications
Forward Jenkins controller logs and host telemetry to a central data lake for correlation across build events and file access
Monitor plugin inventory across Jenkins controllers to identify installations running Ivy Report Plugin 1.2 or earlier

How to Mitigate CVE-2026-70448

Immediate Actions Required

Inventory Jenkins controllers to identify installations of the Ivy Report Plugin at version 1.2 or earlier
Restrict Job/Configure and Job/Build permissions to trusted users until a patched version is deployed
Review recent Ivy report artifacts for external entity declarations and investigate any matches
Isolate Jenkins controllers from sensitive internal services that should not be reachable from build infrastructure

Patch Information

Refer to the Jenkins Security Advisory #SECURITY-3899 for the current fix status and upgrade guidance. If no fixed version is listed, uninstall the plugin or apply the workarounds below until a patched release is available.

Workarounds

Disable or uninstall the Ivy Report Plugin on Jenkins controllers where it is not required
Restrict which users can submit or modify Ivy report inputs by tightening Jenkins role-based access control
Run Jenkins controllers with network egress restrictions that block access to internal management interfaces and metadata services
Apply file system permissions on the Jenkins controller to limit which files the Jenkins service account can read

bash

# Configuration example: identify Jenkins controllers running the vulnerable plugin
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="ivy-report") | {shortName, version, enabled}'