CVE-2026-84672
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display nam…
Published: 2026-09-02 · CVSS: 8.8 · CVSS 3.1
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7