Read the docs
TI-2026-41218 Aliases CVE-2026-57281GHSA-cfj9-2vgr-hpxp

Protection mechanism failure in Jenkins Script Security Plugin

Priority LOW 37CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693 and CWE-917.

Summary

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00923 60th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:script-security (Maven): 1402.1405.vc96e74964250Red Hat: 11 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Script Security Pluginup to 1402.v94c9ce464861—No fix listedCNA
—org.jenkins-ci.plugins:script-security (Maven)before 1402.1405.vc96e749642501402.1405.vc96e74964250Patch availableGHSA-cfj9-2vgr-hpxp
  • Jenkins Script Security Plugin VendorJenkins Affected up to 1402.v94c9ce464861 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:script-security (Maven) Vendor— Affected before 1402.1405.vc96e74964250 Fixed in 1402.1405.vc96e74964250 Patch available GHSA-cfj9-2vgr-hpxp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*up to 1402.v94c9ce464861VulnerableJenkins
  • cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:* Versions up to 1402.v94c9ce464861 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-cfj9-2vgr-hpxp org.jenkins-ci.plugins:script-security (Maven) Fixed in 1402.1405.vc96e74964250 Advisory →

Red Hat 11 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 8 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Jenkins Script Security Plugin — Jenkins Security Advisory 2026-06-24

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-41217 Protection mechanism failure in Jenkins Script Security PluginPriority MEDIUM 41
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Not affected: 11 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57281
  2. 2026-10-03 Alias added: GHSA-cfj9-2vgr-hpxp

References

Advisory 2

Other 17

  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15845 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1HIGH 8.8
  • TI-2024-22597 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1CRITICAL 9.8
  • TI-2019-15850 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1HIGH 8.8
  • TI-2019-15885 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2019-07740 Code injection in Jenkins Script Security Plugin CVSS 3.1CRITICAL 9.9
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences