CVE-2026-14336

Name of the Vulnerable Software and Affected Versions PIA (affected versions not specified)

Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a userinfo trick (e.g., https://ci.eclipse.org@evil.host) or a suffix trick (e.g., https://ci.eclipse.org.evil.host), redirecting OIDC discovery and JWKS fetches to a server under their control. An unauthenticated caller of the 'POST /v1/upload/sbom' endpoint can exploit this to force the system to make outbound HTTP(S) requests to an arbitrary host and cause the oidc.verify token() function to accept a JWT signed with the attacker's own key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.