CVE-2026-70431: Code Injection
Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jenkinsci/jenkins-multijob-pluginto a version that resolves this vulnerability.Fixed in 669.v9d96a_d9c71b_0 - Compensating control
Restrict the Jenkins permissions Item/Create and Item/Configure so only trusted users can create or configure jobs, reducing the ability to exploit Groovy scripting features in the vulnerable Multijob Plugin versions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70431?
CVE-2026-70431 has a risk score of 69, indicating a significant security vulnerability.
How do I fix CVE-2026-70431?
To address CVE-2026-70431, upgrade Jenkins Multijob Plugin to version 670 or later.
What permissions are required to exploit CVE-2026-70431?
Attackers need Item/Create or Item/Configure permissions to exploit CVE-2026-70431.
What does CVE-2026-70431 allow attackers to do?
CVE-2026-70431 allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
Which component of Jenkins is affected by CVE-2026-70431?
CVE-2026-70431 affects the Jenkins Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier.