Jenkins Script Security EUVD-2026-80753

Requires an authenticated Jenkins account holding permission to define and run sandboxed scripts, including Pipeline (Job/Configure or equivalent script-authoring rights); this is the primary limiter and the reason for PR:L. The attacker must additionally craft a Groovy script that calls a method added dynamically to a class at runtime - the specific call path the sandbox fails to check (AC:H). No user interaction and no non-default configuration are needed: any Jenkins running Script Security Plugin ≤1415.v9a_f9b_3a_c253d with sandboxed scripting enabled is affected. Risk is highest on multi-tenant/shared Jenkins where lower-trust users are delegated Pipeline authoring; single-admin instances where only trusted operators write scripts face little practical exposure since those users already have broad access.

This is a genuine sandbox-escape leading to code execution on the Jenkins controller - a real priority for any Jenkins operator, but its severity is gated by prerequisites that keep it below a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) is internally consistent with the description: network-facing (scripts submitted via the Jenkins web UI/Pipeline), but AC:H because the attacker must craft a script that specifically reaches methods added dynamically to a class at runtime (the un-checked call path), and PR:L because exploitation requires an account already permitted to define and run sandboxed scripts. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The signals are non-conflicting: high impact (full sandbox escape = arbitrary code as the Jenkins process) offset by a meaningful authentication/complexity barrier. Note the CWE-693 (protection mechanism failure) and the 'Authentication Bypass' tag are imprecise - this is a sandbox/authorization boundary bypass by an already-authenticated low-trust user, not an authentication bypass. Overall: patch promptly, especially on multi-tenant Jenkins where lower-trust users can author Pipelines, but there is no evidence of widespread automated exploitation.

A user with permission to write and run a sandboxed Pipeline job (a common delegation on shared Jenkins instances) authors a Groovy script that invokes a method added dynamically to a class at runtime, which the Script Security sandbox fails to intercept. This lets them execute code outside the sandbox with the privileges of the Jenkins controller process, reading credentials or running arbitrary commands. No public exploit code was identified at time of analysis; exploitation requires an existing script-author account and a script crafted to hit the specific unchecked call path (AC:H).