CVE-2026-70429 in Jenkins
Summary
by MITRE • 08/05/2026
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within Jenkins versions prior to 2.575 and LTS 2.568.1 where the system exhibits inconsistent handling of case sensitivity in user and group names. The flaw allows malicious actors to exploit this inconsistency by creating new users or groups whose names, when compared in a case-insensitive manner, match existing identifiers. This creates a scenario where attackers can potentially impersonate legitimate users or gain unauthorized access to permissions associated with those accounts.
The technical root cause stems from improper normalization and comparison logic within Jenkins authentication and authorization subsystems. When user or group names are processed, the system fails to consistently apply case-sensitive comparisons throughout all operational contexts. This inconsistency creates a window where two distinct identifiers can be treated as equivalent in certain scenarios while remaining distinguishable in others. The vulnerability specifically impacts the user management and permission assignment mechanisms that rely on string comparison operations.
The operational impact of this vulnerability extends beyond simple impersonation capabilities. Attackers can leverage this flaw to escalate privileges by creating groups with case-insensitive matching names that align with existing administrative groups or roles. This creates a potential pathway for privilege escalation attacks where malicious users can gain access to sensitive system functions and data. The inconsistency also affects role-based access control implementations, potentially allowing unauthorized access to restricted resources through carefully crafted user or group name creation.
This vulnerability maps to CWE-284 Access Control Bypass and aligns with ATT&CK technique T1078 Valid Accounts where adversaries use legitimate credentials to gain access to systems. The inconsistent case handling creates a form of credential confusion that can be exploited by attackers who understand the system's flawed comparison mechanisms. Security controls that rely on user and group name uniqueness become ineffective when case-insensitive matching is not consistently applied across all security contexts.
Mitigation strategies should focus on implementing consistent case-sensitive comparison logic throughout Jenkins user and group management operations. Organizations should upgrade to Jenkins versions 2.575 or later where this inconsistency has been addressed through improved normalization of user and group identifiers. Additional defensive measures include implementing strict access controls for user creation operations, monitoring for unusual user or group creation patterns, and regular auditing of user and group permissions to detect potential impersonation attempts. The system should also enforce consistent case handling in all authentication and authorization contexts to prevent similar issues from occurring in other components or future versions.