What is GHSA-298v-p382-mwvw?

GHSA-298v-p382-mwvw is a security advisory published by GitHub Security Advisories with Low severity. Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a...

Which CVE IDs does GHSA-298v-p382-mwvw cover?

GHSA-298v-p382-mwvw covers the following CVE IDs: CVE-2026-70437. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-298v-p382-mwvw?

GHSA-298v-p382-mwvw has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-298v-p382-mwvwLowCVSS 3.7

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-70437 →

📋 Description

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-70437
https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3918
https://github.com/advisories/GHSA-298v-p382-mwvw