CVE-2026-70429
CVE-2026-70429: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.8
Medium [CVE-2026-70429] Privilege escalation via inconsistent case sensitivity in user and group names
CVE-2026-70429Source published Source updated
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances. A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation. Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2…
- Affected products in this advisory
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
7 more entries in the full advisory.
- Source-reported affected versions
- 2.575
- 2.568.1
- Source-reported fixed versions
- ocp-tools-4/jenkins-rhel8:1786628667
- ocp-tools-4/jenkins-rhel8:1786628681
- ocp-tools-4/jenkins-rhel8:1786533561
- ocp-tools-4/jenkins-rhel8:1786533565
18 more entries in the full advisory.
- Mitigation guidance
- Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.