CVE-2026-70429
Received Received - Intake

Jenkins User Impersonation via Case-Insensitive Name Matching

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Jenkins Project

Description
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70429
EUVD
EUVD-2026-53523

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jenkins jenkins to 2.576 (exc)
jenkins jenkins_lts to 2.569 (exc)
jenkins jenkins to 2.569 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Jenkins 2.575 and earlier versions allows attackers to create users or groups with names that case-insensitively match existing ones. This can lead to impersonation of other users or unauthorized access to their permissions due to inconsistent handling of case sensitivity in user and group names.

Impact Analysis

If you use an affected Jenkins version, attackers could impersonate legitimate users or gain unauthorized permissions by creating accounts with similar names. This may result in data breaches, unauthorized access to sensitive information, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements under GDPR (data protection) and HIPAA (health information security). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Upgrade Jenkins to version 2.576 or later and LTS to 2.568.2 or later to address the case-insensitivity handling issue in user and group names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart