Skip to main content

Jenkins Script Security Plugin EUVDEUVD-2026-38761

| CVE-2026-57281 HIGH
Protection Mechanism Failure (CWE-693)
2026-06-24 jenkins GHSA-cfj9-2vgr-hpxp
Jenkins Information Disclosure Jenkins Script Security Plugin
7.5
CVSS 3.1 · Vendor: jenkins
Share

Severity by source

Vendor (jenkins) PRIMARY
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.5 HIGH
qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 24, 2026 - 13:20 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Articles & Coverage 2

News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 25, 2026 News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 24, 2026

Analysis

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jenkins Script Security Plugin

View all
CVE-2026-57280 HIGH
8.8 Jun 24

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2013-0431 MEDIUM POC
5.3
CVE-2025-40536 HIGH POC
8.1
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8
CVE-2026-32202 MEDIUM POC
4.3
CVE-2017-10952 HIGH POC
8.8
CVE-2022-32845 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

Share

EUVD-2026-38761 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy