CVE-2026-84658
UnknownSummary
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
Risk Assessment
An attacker can access the script approval configuration, potentially revealing information about approved scripts and enabling further attacks.
Recommendation
Update the Script Security plugin to a version that fixes this vulnerability. Restrict the ability to submit forms to trusted users.
Other vulnerabilities in Jenkins Script Security Plugin
See all- CVE-2026-84659Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
- CVE-2016-3102High
The Script Security plugin in Jenkins before version 1.18.1 may allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs direct field access or get/set array operations.
- CVE-2026-57281High
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Original NVD description (English source)
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.