CVE-2026-70436
Received Received - Intake

Jenkins External Workspace Manager Plugin Path Traversal Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Jenkins Project

Description
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70436
EUVD
EUVD-2026-53530

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jenkinsci external_workspace_manager_plugin to 1.4.1 (exc)
jenkinsci external_workspace_manager_plugin to 1.4.0 (exc)
jenkinsci external_workspace_manager_plugin to 1.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jenkins External Workspace Manager Plugin versions 1.4.1 and earlier have a permission check flaw. In version 1.4.0 and earlier, no permission check was performed when accessing externally-managed workspaces via the workspace browser. In version 1.4.1, an improper permission check was implemented. This allows attackers with Overall/Read permission to read files in workspaces they are not authorized to access.

Detection Guidance

To detect this vulnerability, check if Jenkins External Workspace Manager Plugin version 1.4.1 or earlier is installed. Inspect plugin versions via Jenkins UI or by examining plugin directories for the vulnerable versions.

Impact Analysis

If you use the affected Jenkins plugin, attackers with minimal Overall/Read permissions could access sensitive files in workspaces they should not be able to read. This could lead to unauthorized data exposure, potential data leaks, or further exploitation depending on the exposed files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized data exposure may result in regulatory penalties, legal consequences, and loss of trust.

Mitigation Strategies

Immediately update the Jenkins External Workspace Manager Plugin to the latest version. If an update is unavailable, consider disabling the plugin or restricting Overall/Read permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart