PatchTheCVECVE-2026-70437: Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time
22
Routine
LOW 3.7REMOTE
CVE-2026-70437 is a low-severity flaw (CVSS 3.7) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 82%) |
| CISA exploited list | No |
| Weakness | CWE-208 |
| Published | 2026-08-05 |
| Last modified | 2026-10-23 |
Publisher (CNA): Jenkins Project
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.