CVE-2026-70446 in CodeSonar Plugin
Summary
by MITRE • 08/05/2026
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within the Jenkins CodeSonar plugin version 3.6.0 and earlier, where insufficient permission validation allows unauthorized access to credential information. The flaw specifically affects users who possess only the Overall/Read permission level within Jenkins, which typically should restrict them to reading basic system information without accessing sensitive data. However, due to missing authorization checks in the plugin's code implementation, these users can exploit the vulnerability to discover credential identifiers stored within the Jenkins credential store. This represents a critical security weakness that violates fundamental principle of least privilege and proper access control enforcement.
The technical nature of this vulnerability stems from inadequate input validation and permission verification mechanisms within the plugin's credential enumeration functions. When legitimate users with read-only permissions attempt to interact with credential-related endpoints, the plugin fails to properly verify whether the requesting user has sufficient privileges to access such sensitive information. This design flaw allows attackers to perform credential ID enumeration through crafted requests that bypass normal authorization checks. The vulnerability can be classified under CWE-284 Access Control Issues as it involves improper access control enforcement and represents a privilege escalation vector within the Jenkins security model.
The operational impact of this vulnerability extends beyond simple information disclosure, as credential ID enumeration provides attackers with critical intelligence for subsequent attacks. Once an attacker discovers valid credential identifiers, they can then attempt brute force attacks against these specific credentials or use them in combination with other vulnerabilities to gain unauthorized system access. The attack surface expands significantly when considering that Jenkins typically stores various types of credentials including usernames, passwords, API keys, and SSH keys, all of which could be targeted by malicious actors who have obtained this enumeration information. This vulnerability aligns with ATT&CK technique T1552 Credential Access through credential harvesting and reconnaissance activities.
Organizations utilizing Jenkins CodeSonar plugin versions 3.6.0 or earlier face substantial risk from this vulnerability as it essentially provides a backdoor for unauthorized credential discovery without requiring elevated privileges. The remediation approach involves upgrading to a patched version of the plugin where proper permission checks have been implemented to ensure that only users with appropriate administrative permissions can access credential information. Additionally, system administrators should review and enforce strict access control policies within Jenkins, ensuring that users have the minimum required permissions for their roles. Security monitoring should be enhanced to detect unusual credential enumeration activities, and regular security audits should verify proper implementation of authorization controls across all installed plugins.
The vulnerability demonstrates the critical importance of implementing comprehensive access control mechanisms even in seemingly benign plugin functionalities. It highlights how a single missing permission check can create significant security risks within enterprise CI/CD environments where Jenkins serves as a central automation platform. Organizations should also consider implementing additional security measures such as multi-factor authentication for administrative accounts, regular credential rotation policies, and network segmentation to limit the potential impact of such vulnerabilities. This issue reinforces industry best practices around secure coding principles and emphasizes that all user interactions with sensitive system components must undergo proper authorization verification regardless of the user's initial permission level.