VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 5, 2026· Updated Oct 23, 2026

CVE-2026-70429

CVE-2026-70429

Description

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Jenkins Project/Jenkins3 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*+ 2 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <2.568.2
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*range: <2.576
    • (no CPE)range: <=2.575, LTS <=2.568.1
  • osv-coords2 versions
    pkg:apk/chainguard/jenkins-2.568pkg:bitnami/jenkins
    < 2.568.2-r0+ 1 more
    • (no CPE)range: < 2.568.2-r0
    • (no CPE)range: < 2.568.2

Patches

Vulnerability mechanics

References

1

News mentions

1