CVE-2026-70431
Received Received - Intake

Jenkins Multijob Plugin Groovy Scripting Arbitrary Code Execution

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Jenkins Project

Description
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70431
EUVD
EUVD-2026-53525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkinsci multijob_plugin 669.v9d96a_d9c71b_0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jenkins Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier have a flaw where Groovy scripting features are not properly restricted by the Script Security Plugin. This allows attackers with Item/Create or Item/Configure permissions to execute arbitrary code on the Jenkins controller, potentially taking control of the entire system.

Detection Guidance

To detect this vulnerability, check if Jenkins Multijob Plugin version 669.v9d96a_d9c71b_0 or earlier is installed. Use the Jenkins script console to run: 'println(Jenkins.instance.pluginManager.plugins.findAll { it.shortName == "multijob" }.version)' to verify the version. If vulnerable, update the plugin immediately.

Impact Analysis

If exploited, this vulnerability could allow unauthorized code execution on your Jenkins controller. This may lead to data breaches, system compromise, or disruption of Jenkins services. Attackers could steal sensitive data, install malware, or pivot to other systems in your network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance. Organizations may face fines, legal penalties, and reputational damage due to data breaches resulting from this flaw.

Mitigation Strategies

Update Jenkins Multijob Plugin to a version later than 669.v9d96a_d9c71b_0. Restrict Item/Create and Item/Configure permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart