CVE-2026-70446: Jenkins CodeSonar Plugin vulnerability

Q: What is CVE-2026-70446?

CVE-2026-70446 is a vulnerability in the Jenkins CodeSonar Plugin that allows users with Overall/Read permission to enumerate credential IDs due to missing permission checks.

Q: What is the severity of CVE-2026-70446?

The severity of CVE-2026-70446 is rated as 26, indicating a significant security risk.

Q: How do I fix CVE-2026-70446?

To fix CVE-2026-70446, upgrade to Jenkins CodeSonar Plugin version 3.6.1 or later where the permission checks have been implemented.

Q: Which versions of Jenkins are affected by CVE-2026-70446?

Jenkins CodeSonar Plugin versions 3.6.0 and earlier are affected by CVE-2026-70446.

Q: Can CVE-2026-70446 lead to data exposure?

Yes, CVE-2026-70446 can lead to data exposure by allowing unauthorized users to enumerate credential IDs stored in Jenkins.

Published Aug 5, 2026

Updated

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected Software

1 affected component

Jenkins CodeSonar Plugin<=3.6.0

Event History

Aug 5, 2026

CVE Published

via MITRE·05:40 PM

Data Sourced

via MITRE·05:40 PM

Description

Frequently Asked Questions

What is CVE-2026-70446?

CVE-2026-70446 is a vulnerability in the Jenkins CodeSonar Plugin that allows users with Overall/Read permission to enumerate credential IDs due to missing permission checks.

What is the severity of CVE-2026-70446?

The severity of CVE-2026-70446 is rated as 26, indicating a significant security risk.

How do I fix CVE-2026-70446?

To fix CVE-2026-70446, upgrade to Jenkins CodeSonar Plugin version 3.6.1 or later where the permission checks have been implemented.

Which versions of Jenkins are affected by CVE-2026-70446?

Jenkins CodeSonar Plugin versions 3.6.0 and earlier are affected by CVE-2026-70446.

Can CVE-2026-70446 lead to data exposure?

Yes, CVE-2026-70446 can lead to data exposure by allowing unauthorized users to enumerate credential IDs stored in Jenkins.

CVE-2026-70446: Jenkins CodeSonar Plugin vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2026-70446?

What is the severity of CVE-2026-70446?

How do I fix CVE-2026-70446?

Which versions of Jenkins are affected by CVE-2026-70446?

Can CVE-2026-70446 lead to data exposure?

Company

Resources

Contact

Frequently Asked Questions

What is CVE-2026-70446?

What is the severity of CVE-2026-70446?

How do I fix CVE-2026-70446?

Which versions of Jenkins are affected by CVE-2026-70446?

Can CVE-2026-70446 lead to data exposure?