CVE-2026-70435 in SCM-Manager Plugin
Summary
by MITRE • 08/05/2026
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability exists within the Jenkins SCM-Manager plugin version 1.11.1 and earlier, representing a critical authorization flaw that undermines the security posture of Jenkins environments. The issue stems from a missing permission check that allows authenticated users with only Overall/Read permission to execute arbitrary network requests to attacker-controlled endpoints. This misconfiguration creates a pathway for credential harvesting where attackers can leverage their limited access privileges to capture sensitive authentication information stored within Jenkins. The vulnerability operates by exploiting the plugin's functionality to connect to external systems using specified credentials IDs, effectively bypassing normal access controls that should restrict such operations to authorized personnel only.
The technical implementation of this flaw involves the SCM-Manager plugin failing to validate whether the requesting user possesses appropriate authorization levels before executing network communication requests. This missing validation occurs during the credential retrieval and connection process where the plugin accepts attacker-specified URL endpoints and credentials identifiers without proper access verification. The vulnerability aligns with CWE-284 which addresses improper access control mechanisms, specifically targeting insufficient authorization checks in plugin components. Attackers can exploit this weakness by first obtaining Overall/Read permission through legitimate means or social engineering, then leveraging the plugin's functionality to target specific URLs where they can capture credentials from Jenkins' credential store.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables attackers to potentially escalate their access within the Jenkins environment and gain unauthorized access to connected systems. When attackers successfully exploit this vulnerability, they can extract stored credentials for various systems including version control repositories, databases, and other external services that Jenkins manages. This capability creates a significant risk for organizations relying on Jenkins for continuous integration and deployment processes, as compromised credentials can lead to full system compromise and unauthorized code deployments. The attack vector demonstrates characteristics consistent with ATT&CK technique T1555.003 which focuses on credential access through the use of stolen or compromised credentials.
Organizations should immediately implement mitigations including updating to the patched version of the SCM-Manager plugin, reviewing and strengthening permission controls within Jenkins environments, and implementing network-level restrictions to prevent unauthorized outbound connections from Jenkins servers. Additionally, security teams should monitor for suspicious network activity patterns that might indicate credential harvesting attempts and establish proper logging mechanisms to track plugin usage and access attempts. The vulnerability highlights the importance of comprehensive security testing for third-party plugins and the necessity of maintaining up-to-date software components to prevent exploitation of known authorization flaws. Regular security audits should verify that all Jenkins plugins properly implement access controls and that administrative privileges are appropriately restricted to minimize potential impact from similar vulnerabilities.