CVE-2026-70429 Details
Description
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.
A vulnerability exists in Jenkins versions through 2.575 and LTS through 2.568.1, where case-insensitivity in user and group names is handled inconsistently. This flaw allows attackers to create users or groups with names that case-insensitively match existing ones, potentially leading to impersonation or unauthorized permission grants. The issue arises from a security realm that permits certain Unicode characters in names and allows the creation of names that match existing ones case-insensitively.
Users of Jenkins should update to version 2.576 or 2.568.2. For those using Jenkins plugins, refer to the specific plugin update recommendations in the Jenkins Security Advisory 2026-08-05.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins jenkins | < 2.568.2 < 2.576 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |