CVE-2026-70431 Details
Description
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
A vulnerability allowing arbitrary code execution has been identified in the Jenkins Multijob Plugin, specifically in versions through 669.v9d96a_d9c71b_0. The issue arises because the plugin's Groovy scripting features do not properly integrate with the Script Security Plugin. This flaw allows attackers with Item/Create or Item/Configure permission to execute arbitrary code on the Jenkins controller's JVM.
Users of the Jenkins Multijob Plugin should update to version 677.v7ffc23d6a_4c2, which integrates with the Script Security Plugin to enforce sandboxing of Groovy scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3823%20(1) | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |