CVE-2026-42519
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
CVE-2026-42519 is a medium vulnerability (CVSS 4.3) in Jenkins Script Security, published April 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 7th percentile. Fixed in org.jenkins-ci.plugins:script-security 1402.v94c9ce464861.
- Severity
- 4.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.17%EPSS, 7th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1402.v94c9ce464861org.jenkins-ci.plugins:script-security +1 more
Description
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:script-securityMaven | before 1402.v94c9ce464861 | 1402.v94c9ce464861 |
org.jenkins-ci.plugins:script-securityMaven | before 1402.v94c9ce464861, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46 | 1402.v94c9ce464861 |
What each source reports
CVE List Score used
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
- Record
CVE-2026-42519- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-26220
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
- Record
EUVD-2026-26220- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p334-gfhq-c7w6
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
- Record
GHSA-p334-gfhq-c7w6- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
- Record
CVE-2026-42519- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
- Record
CVE-2026-42519- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-p334-gfhq-c7w6
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
- Record
GHSA-p334-gfhq-c7w6- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 114 versions. The JSON record has them.