CVE-2026-42519

Received Received - Intake

Missing Permission Check in Jenkins Script Security Plugin

Publication date: 2026-04-29

Last updated on: 2026-05-06

Assigner: Jenkins Project

Description

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-29

Last Modified

2026-05-06

Generated

2026-07-26

AI Q&A

2026-04-29

EPSS Evaluated

2026-07-25

NVD

CVE-2026-42519

EUVD

EUVD-2026-26220

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	script_security	to 1399.ve6a_66547f6e1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing permission check in the Jenkins Script Security Plugin version 1399.ve6a_66547f6e1 and earlier. It allows attackers who have Overall/Read permission to enumerate pending and approved Script Security classpaths.

Detection Guidance

This vulnerability involves a missing permission check in an HTTP endpoint of the Jenkins Script Security Plugin, allowing enumeration of pending and approved Script Security classpaths by users with Overall/Read permission.

Detection would involve monitoring HTTP requests to the Jenkins Script Security Plugin endpoints to identify attempts to enumerate classpaths without proper permissions.

Specific commands or detection scripts are not provided in the available resources.

Impact Analysis

An attacker with Overall/Read permission can exploit this vulnerability to gain information about pending and approved Script Security classpaths. This could potentially aid in further attacks or unauthorized access by revealing internal details about the Jenkins environment.

Mitigation Strategies

The immediate mitigation step is to upgrade the Jenkins Script Security Plugin to version 1402.v94c9ce464861 or later.

This update includes a fix that enforces Overall/Administer permission to enumerate pending and approved Script Security classpaths, preventing unauthorized enumeration.

Additionally, review and restrict user permissions to ensure that only trusted users have Overall/Read or higher permissions.

Hi! I’m here to help you understand CVE-2026-42519. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70