EUVD-2026-38760
GHSA-c3jm-9vj7-5v66
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Jenkins Script Security Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
Blast Radius
ecosystem impact- 5 maven packages depend on org.jenkins-ci.plugins:script-security (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 1402.1405.vc96e74964250.
Articles & Coverage 2
Executive ViewAI
Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier contain a sandbox bypass vulnerability (CVSS 8.8) that enables arbitrary code execution on the Jenkins controller through maliciously crafted Groovy scripts. This threatens the integrity and security of the entire CI/CD pipeline and any systems it can access. Organizations running this plugin face immediate risk to their build, deployment, and release infrastructure until a patch becomes available.
Within 24 hours, inventory all Jenkins instances running Script Security Plugin version 1402.v94c9ce464861 or earlier and determine which are exposed to script submission. Within 7 days, implement interim controls: restrict Groovy script submission permissions to a minimal set of trusted administrators only, isolate the Jenkins controller at the network level, and disable the Script Security Plugin entirely if it is not operationally required. Within 30 days, continuously monitor the Jenkins SECURITY-3792 advisory for patch availability; deploy the fix immediately upon release, maintain compensating controls until remediation is complete, and conduct a security review of all scripts submitted during the vulnerability window.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict script submission permissions to a minimal set of trusted personnel; implement network-level access controls limiting Jenkins controller connectivity; disable the Script Security Plugin if operational requirements permit; enable comprehensive audit logging and alerting on script submissions and controller access; require human code review of all scripts before execution; isolate Jenkins agents in network segments separate from sensitive systems; consider architectural changes to avoid reliance on sandboxed script execution for untrusted inputs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who ho
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated att
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with
Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows an authenticated Jenkins
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier: when a user with job-confi
Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed
Arbitrary code execution in the Jenkins Script Security Plugin (versions up to and including 1415.v9a_f9b_3a_c253d) lets
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 ena
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to d
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user
Exploit-DB