{"id":"CVE-2026-57281","aliases":["EUVD-2026-38761","GHSA-cfj9-2vgr-hpxp"],"status":"published","title":"Jenkins Script Security Plugin has a script security bypass vulnerability","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00923,"percentile":0.60701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693","CWE-917","CWE-93"],"published":"2026-06-24T13:20:04Z","modified":"2026-10-27T02:30:38Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","fixed_in":["1402.1405.vc96e74964250"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1402.1405.vc96e74964250"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1402.1405.vc96e74964250"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.29.1","1.3","1.30","1.31","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.4","1.40","1.41","1.42","1.43","1.44","1.44.1","1.45","1.46","1.46.1","1.47","1.48","1.49","1.5","1.50","1.51","1.52","1.53","1.54","1.54.1","1.54.2","1.54.3","1.54.4","1.55","1.56","1.57","1.57.1","1.57.2","1.57.3","1.57.4","1.57.5","1.57.6","1.58","1.59","1.6","1.60","1.60.1","1.61","1.62","1.63","1.63.1","1.64","1.65","1.66","1.66.1","1.66.2","1.66.3","1.66.4","1.66.5","1.67","1.68","1.69","1.7","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.78.1","1.8","1.9","1118.vba21ca2e3286","1125.v132f99385e1b_","1131.v8b_b_5eda_c328e","1138.v8e727069a_025","1140.vf967fb_efa_55a_","1145.1148.vf6d17a_a_a_eef6","1145.vb_cf6cf6ed960","1146.vdf547f19a_473","1158.v7c1b_73a_69a_08","1172.v35f6a_0b_8207e","1175.1177.vda_175b_77d144","1175.1179.vea_f7532629e1","1175.1180.v36a_3fb_2dec9c","1175.v4b_d517d6db_f0","1183.v774b_0b_0a_a_451","1184.v85d16b_d851b_3","1189.vb_a_b_7c8fd5fde","1190.v65867a_a_47126","1209.v50b_005db_19db","1218.v39ca_7f7ed0a_c","1228.vd93135a_2fb_25","1229.v4880b_b_e905a_6","1244.ve463715a_f89c","1251.1253.v4e638b_e3b_221","1251.vfe552ed55f8d","1264.vecf66020eb_7d","1265.va_fb_290b_4b_d34","1269.v639888f5e366","1271.vdede89739a_81","1273.v66c1964f0dfd","1274.v2b_33362a_f2f5","1275.v23895f409fb_d","1281.v22fb_899df1a_e","1294.v99333c047434","1301.v0079b_cd0cdfa_","1305.v487433146192","1310.vf24a_dfce068b_","1313.v7a_6067dc7087","1321.va_73c0795b_923","1326.vdb_c154de8669","1335.vf07d9ce377a_e","1336.vf33a_a_9863911","1341.va_2819b_414686","1354.va_70a_fe478c7f","1358.vb_26663c13537","1361.v913100720139","1362.1364.v4cf2dc5d8776","1362.v67dc1f0e1b_b_3","1365.1367.va_3b_b_89f8a_95b_","1365.v4778ca_84b_de5","1366.vd44b_49a_5c85c","1367.vdf2fc45f229c","1368.vb_b_402e3547e7","1369.v9b_98a_4e95b_2d","1373.vb_b_4a_a_c26fa_00","1378.vf25626395f49","1385.v7d2d9ec4d909","1399.ve6a_66547f6e1","1402.v94c9ce464861"]}],"products":[{"vendor":"jenkins","product":"script_security"},{"vendor":"jenkins project","product":"jenkins script security plugin"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"openshift developer tools and services 4.12"},{"vendor":"red hat","product":"openshift developer tools and services 4.13"},{"vendor":"red hat","product":"openshift developer tools and services 4.14"},{"vendor":"red hat","product":"openshift developer tools and services 4.15"},{"vendor":"red hat","product":"openshift developer tools and services 4.16"},{"vendor":"red hat","product":"openshift developer tools and services 4.17"},{"vendor":"red hat","product":"openshift developer tools and services 4.18"},{"vendor":"red hat","product":"openshift developer tools and services 4.19"},{"vendor":"red hat","product":"openshift developer tools and services 4.20"},{"vendor":"red hat","product":"openshift developer tools and services 4.21"},{"vendor":"red hat","product":"openshift developer tools and services 4.22"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57281","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492200","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57281","tags":["advisory"]},{"url":"https://github.com/jenkinsci/script-security-plugin/commit/c96e7496425031182b6fc11ef1c55b9ae4fa7cc2","tags":["web"]},{"url":"https://github.com/jenkinsci/script-security-plugin/releases/tag/1402.1405.vc96e74964250","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cfj9-2vgr-hpxp"},{"url":"https://github.com/jenkinsci/script-security-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-57281","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.","status":"published","published":"2026-06-24T13:20:04.648Z","modified":"2026-09-07T12:05:04.66Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-693","CWE-93","CWE-917"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-38761","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.","status":"published","published":"2026-06-24T13:20:04Z","modified":"2026-09-07T12:05:04Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-cfj9-2vgr-hpxp","title":"Jenkins Script Security Plugin has a script security bypass vulnerability","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.\n\nThis may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.\n\nThe Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.\n\nScript Security Plugin 1402.1405.vc96e74964250 rejects any annotation carrying an extensions member during sandbox compilation, before Groovy can resolve or execute the referenced script.","status":"published","published":"2026-06-24T15:31:47Z","modified":"2026-09-25T18:06:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-93","CWE-917"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2026-57281","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.","status":"published","published":"2026-06-24T14:17:34.023Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-93","CWE-693","CWE-917"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-57281","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.","status":"published","published":"2026-06-24T14:17:34.023Z","modified":"2026-10-27T02:30:38.985475317Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"GHSA-cfj9-2vgr-hpxp","title":"Jenkins Script Security Plugin has a script security bypass vulnerability","description":"Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.\n\nThis may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.\n\nThe Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.\n\nScript Security Plugin 1402.1405.vc96e74964250 rejects any annotation carrying an extensions member during sandbox compilation, before Groovy can resolve or execute the referenced script.","status":"published","published":"2026-06-24T15:31:47Z","modified":"2026-09-25T18:15:04.458167434Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-917","CWE-93"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}