EUVD-2026-53525
GHSA-vxm7-6w3j-gm87
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible Jenkins UI, low-privilege Item/Configure grants trigger unsandboxed controller JVM code execution, constituting a scope change with full C/I/A impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The Multijob Plugin provides multi-phase build orchestration within Jenkins, and it exposes Groovy scripting hooks for conditional logic and build step configuration. In the Jenkins security model, the Script Security Plugin acts as a sandboxing layer for Groovy scripts - restricting access to dangerous classes and methods unless an administrator has explicitly approved them via a script approval workflow. Plugins that implement Groovy evaluation without hooking into this framework bypass sandbox enforcement entirely, allowing scripts to call arbitrary Java and JVM APIs. This is a well-understood vulnerability class in the Jenkins ecosystem, structurally similar to CWE-693 (Protection Mechanism Failure) - the protection mechanism (Script Security sandbox) exists and is functional, but the plugin routes around it. The Jenkins controller JVM runs with the privileges of the OS user account hosting Jenkins, which in many deployments has broad filesystem access, credential store access, and internal network reachability. No CPE or CWE identifiers were included in the input data for this specific CVE.
RemediationAI
Upgrade the Multijob Plugin to version 677.v7ffc23d6a_4c2 or later via the Jenkins plugin manager; this version integrates the plugin's Groovy scripting features with the Script Security Plugin, enforcing sandbox restrictions. The full advisory is at https://www.jenkins.io/security/advisory/2026-08-05/. If an immediate upgrade is not feasible, restrict Item/Create and Item/Configure permissions to only fully trusted administrators or service accounts - note this may break existing developer workflows and pipeline configurations. As a more aggressive compensating control, disable or uninstall the Multijob Plugin entirely; this eliminates the vulnerability surface but will break any pipelines relying on multi-phase job orchestration, requiring migration to alternative approaches such as Jenkins Pipelines with proper Groovy sandboxing. No workaround that preserves plugin functionality while blocking exploitation is apparent given the architectural nature of the bypass.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today