CVE-2026-70433 · Symaro Security Advisory

Description

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

Vendor	Product	Versions
Jenkins Project	Jenkins HCL AppScan Plugin	0 to <=1.8.3

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3771 (vendor-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 06 Aug 2026 07:06 UTC.