Jenkins User/Group Name Case-Insensitivity Impersonation (2.575/2.568.1)
CVE-2026-70429 Published on August 5, 2026

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-70429 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Improper Handling of Case Sensitivity

The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.


Products Associated with CVE-2026-70429

Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.

Jenkins
 

Affected Versions

Jenkins Project Jenkins: