CVE-2026-70429: Jenkins

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

Affected products

• Jenkins Jenkins: before 2.568.2 (fixed in 2.568.2); before 2.576 (fixed in 2.576)

Published 2026-08-05. Last modified 2026-09-08.