CVE-2026-70438: Medium severity Jenkins Parameterized Remote Trigger Plugin vulnerability
Published Aug 5, 2026
·Updated
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected Software
1 affected component
Jenkins Parameterized Remote Trigger Plugin<=3.2.2
Event History
Aug 5, 2026
CVE Published
via MITRE·05:40 PM
Data Sourced
via MITRE·05:40 PM
Description
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-70438?
CVE-2026-70438 has a risk rating of 26, indicating a critical vulnerability.
2
How can I mitigate CVE-2026-70438?
Mitigation for CVE-2026-70438 involves updating the Jenkins Parameterized Remote Trigger Plugin to version 3.2.3 or later.
3
What does CVE-2026-70438 exploit?
CVE-2026-70438 exploits a missing permission check that allows unauthorized users to enumerate credential IDs stored in Jenkins.
4
Who is affected by CVE-2026-70438?
CVE-2026-70438 affects all users of Jenkins Parameterized Remote Trigger Plugin version 3.2.2 and earlier.
5
What are the implications of CVE-2026-70438?
The implications of CVE-2026-70438 include potential exposure of sensitive credential IDs to unauthorized users.