EUVD-2026-70125
GHSA-fc8j-cp67-6ww3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Agrees with provided vector: PR:L (authenticated low-privilege user required), I:L (direct impact is toggling a setting), C:N and A:N since the act of disabling the sandbox does not itself exfiltrate data or crash services.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
5DescriptionCVE.org
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
AnalysisAI
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Jenkins account with at minimum Overall/Read access (PR:L per CVSS vector); anonymous or unauthenticated access cannot trigger this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) captures only the immediate integrity impact of flipping a configuration toggle. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Jenkins Script Security Plugin to the fixed release identified in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3986; the exact fixed version number is not specified in the available input data and must be confirmed directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxe
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 ena
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today