4.3 Medium

CVE-2026-70446 Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission…

Description

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins CodeSonar Plugin 3.6	earliest → 3.6.0	No fix stated

Do you use Jenkins CodeSonar Plugin?

Track this CVE Watch Jenkins CodeSonar Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2026-70446

Timeline

Published August 5, 2026
Last modified August 5, 2026

References

Jenkins Security Advisory 2026-08-05 www.jenkins.io

Track this CVE