CVE-2026-70448
Received Received - Intake

Jenkins Ivy Report Plugin XXE Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Jenkins Project

Description
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70448
EUVD
EUVD-2026-53542

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkinsci ivy_report_plugin to 1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jenkins Ivy Report Plugin 1.2 and earlier is vulnerable to XML external entity (XXE) attacks. This occurs because the plugin does not properly configure its XML parser when processing Ivy report files, allowing attackers to exploit this to read arbitrary files or perform other malicious actions.

Detection Guidance

Detection of CVE-2026-70448 requires checking for the presence of the vulnerable Jenkins Ivy Report Plugin (1.2 or earlier) on your system. Inspect Jenkins plugin installations via the Jenkins web interface or by examining the plugin directory on the Jenkins server. Look for the Ivy Report Plugin version 1.2 or below.

Impact Analysis

If you use the affected Jenkins Ivy Report Plugin, an attacker could exploit this vulnerability to access sensitive files on your system, potentially leading to data breaches or unauthorized system access. This could compromise your Jenkins environment and any data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected plugin may face legal and financial penalties due to potential data exposure.

Mitigation Strategies

Update Jenkins Ivy Report Plugin to the latest version where the XXE vulnerability has been patched. Disable or uninstall the plugin if an update is not available. Review Ivy report files for suspicious content before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70448. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart