CVE-2026-70437
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected…
Published: 2026-08-05 · CVSS: 3.7 · CVSS 3.1
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7