CVE-2026-84659
UnknownSummary
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
Risk Assessment
An attacker can disable the global sandbox, potentially leading to execution of dangerous scripts without restrictions, increasing the risk of system compromise.
Recommendation
Update the Script Security plugin to a version that fixes the missing permission check. Restrict access to global settings and monitor configuration changes.
Other vulnerabilities in Jenkins Script Security Plugin
See all- CVE-2026-84658Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
- CVE-2016-3102High
The Script Security plugin in Jenkins before version 1.18.1 may allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs direct field access or get/set array operations.
- CVE-2026-57281High
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Original NVD description (English source)
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.