CVE-2026-70435 · Symaro Security Advisory

Description

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

Vendor	Product	Versions
Jenkins Project	Jenkins SCM-Manager Plugin	0 to <=1.11.1

References

https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3888 (vendor-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 06 Aug 2026 07:06 UTC.