EUVD-2026-26220Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable via Jenkins HTTP; PR:L for required authenticated account; C:L for classpath enumeration only; I:N and A:N as no write or availability impact is possible.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 11 maven packages depend on org.jenkins-ci.plugins:script-security (5 direct, 6 indirect)
Ecosystem-wide dependent count for version 1402.v94c9ce464861.
DescriptionCVE.org
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
AnalysisAI
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.
Technical ContextAI
The Jenkins Script Security Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_script_security_plugin) implements a Groovy script sandbox on the Jenkins controller, maintaining an allowlist of approved scripts and class paths submitted by developers for administrator review. CWE-862 (Missing Authorization) identifies the root cause: an HTTP endpoint responsible for returning pending and approved classpath entries performs no authorization check beyond the base Overall/Read permission, which Jenkins grants to all authenticated users in most deployments. This is a recurring pattern in Jenkins plugin development where ancillary management endpoints are wired up without per-operation permission guards, allowing low-privilege callers to reach data intended only for administrators.
RemediationAI
Upgrade the Jenkins Script Security Plugin to a version beyond 1399.ve6a_66547f6e1 using the Jenkins Plugin Manager or the vendor advisory at https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3662; the exact patched version number is not independently confirmed in the available data, so consult the advisory directly for the released fix version. As a compensating control where immediate patching is not feasible, restrict Overall/Read access to only trusted, known users - avoid granting any authentication to external or untrusted parties, since this eliminates the attacker's ability to reach the vulnerable endpoint entirely. Note that tightening Jenkins authentication broadly may affect CI/CD automation accounts and should be tested before deployment. No workaround short of access restriction is available for the missing permission check itself.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxe
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 ena
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to d
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today