Jenkins Script Security Plugin CVE-2026-42519

Exploitation requires a valid Jenkins account with at minimum the Overall/Read permission, which is the default base-level permission granted to all authenticated users in most Jenkins configurations - no elevated role, administrator access, or special group membership is required beyond the ability to log in. The Jenkins Script Security Plugin must be installed on the controller instance. Impact is strictly bounded to read-only enumeration of Script Security classpath data - no code execution, configuration modification, or denial of service is possible through this flaw alone. Unauthenticated network access is not sufficient; exploitation is blocked for anonymous users and in Jenkins instances with authentication disabled for reads (if any such configuration exists). The non-automatable SSVC rating reflects that each exploitation attempt requires a valid credential, preventing bulk or spray exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 Medium, accurately reflecting a network-reachable, low-complexity flaw requiring only a valid account and yielding only limited confidentiality impact. EPSS at 0.03% (7th percentile) corroborates a low probability of exploitation in practice. SSVC confirms exploitation status as 'none,' the vulnerability is not automatable, and technical impact is only partial - aligning well with all other signals. No CISA KEV listing and no public POC have been identified at time of analysis, so this is not a crisis-tier issue. The realistic risk is reconnaissance-value information disclosure in multi-tenant or externally-accessible Jenkins environments where untrusted users hold Overall/Read; in tightly controlled single-team Jenkins deployments the practical impact is negligible. No signal conflicts across the available data sources.

An authenticated Jenkins user with a default Overall/Read account sends a crafted HTTP GET request to the Script Security Plugin's classpath enumeration endpoint. Because no additional permission check is performed, the plugin returns the full list of pending and administrator-approved Script Security classpaths, exposing library names, internal package paths, and the state of the admin review queue. The attacker uses this map of approved classes to identify exploitable or sensitive libraries for follow-on privilege escalation attempts within the Groovy sandbox.