PT-2026-68270

Name of the Vulnerable Software and Affected Versions Jenkins SCM-Manager Plugin versions prior to 1.11.2 Description A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL. By providing a specific URL and credentials IDs obtained...

PT-2026-68269

Name of the Vulnerable Software and Affected Versions Jenkins SCM-Manager Plugin versions prior to 1.11.2 Description A cross-site request forgery CSRF flaw allows attackers to force the system to connect to an external URL using specific credentials IDs. This can lead to the capture of credentia...

CVE-2026-70435: Missing Authorization

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70434: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...