Jenkins Script Security Plugin Groovy Sandbox Bypass

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57280

EUVD

EUVD-2026-38760

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	script_security	to 1402.v94c9ce464861 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier. It occurs because the plugin does not properly intercept implicit type casts applied to elements in typed for-each loops within sandboxed Groovy scripts. This flaw allows attackers who can provide such scripts to invoke arbitrary constructors, effectively bypassing the sandbox protection.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code by bypassing the sandbox restrictions in Jenkins. As a result, an attacker could potentially run unauthorized operations, compromise the Jenkins environment, access sensitive data, or disrupt automated build and deployment processes.

Hi! I’m here to help you understand CVE-2026-57280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70