CVE-2026-70433 - Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins

Back Back to CVE browser

MEDIUM

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins

Published Aug 5, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.27%

Description

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

Vendor Jenkins Project Product Jenkins HCL AppScan Plugin Default
unaffected
Affected
- ≥ 0, ≤ 1.8.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins Project	Jenkins HCL AppScan Plugin	unaffected	Affected ≥ 0, ≤ 1.8.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53527
Advisory
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3771
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53527		Advisory
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3771		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jenkins

Published Aug 5, 2026

Updated Aug 6, 2026

Reserved Aug 4, 2026

Link CVE-2026-70433

CISA Vulnrichment

Updated Aug 6, 2026

NVD

Status Awaiting Analysis

Modified Aug 31, 2026

Link CVE-2026-70433

Red Hat

No data

ENISA EUVD

Assigner jenkins

Published Aug 5, 2026

Updated Aug 6, 2026

Link EUVD-2026-53527

GitHub

No data