CVE-2026-70437 Jenkins Webhook Plugin Timing Attack on Bearer Token
CVE-2026-70437 Published on August 5, 2026
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.
Products Associated with CVE-2026-70437
Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.
Affected Versions
Jenkins Project Jenkins Webhook Secret Credentials Provider Plugin:- Before and including 16.v0cfa_f0215cf5 is affected.