CVE-2026-70440 in Qualys Container Scanning Connector Plugin
Summary
by MITRE • 08/05/2026
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Jenkins Qualys Container Scanning Connector Plugin presents a critical stored cross-site scripting vulnerability that arises from inadequate input sanitization within its javascript context. This flaw affects versions 1.8.0.5 and earlier, creating a persistent security risk where malicious actors can inject malicious scripts into user-controlled fields that are subsequently executed in the browser context of other users. The vulnerability specifically manifests when the plugin fails to properly escape or sanitize user-provided data before rendering it within javascript code blocks, allowing attackers with minimal privileges to execute arbitrary javascript commands.
The technical implementation of this vulnerability stems from improper output encoding practices within the plugin's handling of user inputs that are destined for javascript contexts. When administrators or users configure plugin settings through the Jenkins interface, any data entered into configurable fields may be directly embedded into javascript code without proper sanitization. This creates a scenario where an attacker with Item/Configure permission can craft malicious input containing javascript payloads that persist in the system's configuration storage and execute whenever the affected page is loaded. The vulnerability operates under CWE-79 which specifically addresses cross-site scripting flaws, categorizing this as a stored XSS variant since the malicious content is permanently stored within the application's data stores rather than being transmitted through a single request.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with potential access to sensitive information and system manipulation capabilities. Once exploited, the malicious javascript code can access the victim user's session cookies, potentially enabling session hijacking attacks or allowing attackers to perform actions on behalf of authenticated users. The attack vector requires minimal privileges since only Item/Configure permission is necessary, making this vulnerability particularly dangerous in environments where multiple users have configuration access. This could lead to privilege escalation scenarios where an attacker leverages the XSS to gain elevated access rights within the Jenkins environment or extract sensitive build artifacts and credentials.
Mitigation strategies for this vulnerability should prioritize immediate plugin version updates to remediate the identified security flaw, as newer versions typically include proper input sanitization and output encoding mechanisms. Organizations should implement strict input validation policies that enforce proper escaping of all user-controllable data before storage or rendering within javascript contexts. The principle of least privilege should be enforced by restricting Item/Configure permissions to only trusted administrators who require such access for legitimate operational purposes. Additional defensive measures include implementing content security policies that limit script execution capabilities and monitoring system logs for suspicious configuration changes that may indicate exploitation attempts. This vulnerability aligns with ATT&CK technique T1059.007 for JavaScript and T1531 for implantation of malicious code, emphasizing the need for comprehensive security controls beyond simple patch management approaches.