CVE-2026-42519
published 2026-04-29CVE-2026-42519: A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.28%
19.5th percentile
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_binding | — | — |
| jenkins | credentials_binding_plugin | — | — |
| jenkins | github | — | — |
| jenkins | github_branch_source | — | — |
| jenkins | github_branch_source_plugin | — | — |
| jenkins | github_plugin | — | — |
| jenkins | html_publisher | — | — |
| jenkins | html_publisher_plugin | — | — |
| jenkins | jenkins | — | — |
| jenkins | matrix_authorization_strategy | — | — |
| jenkins | matrix_authorization_strategy_plugin | — | — |
| jenkins | script_security | <= 1399.ve6a_66547f6e1 | — |
| jenkins | script_security | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins_project | jenkins_script_security_plugin | <= 1399.ve6a_66547f6e1 | — |
| ocp-tools-4 | jenkins-agent-base-rhel8 | — | — |
| ocp-tools-4 | jenkins-agent-base-rhel9 | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
ghsa·2026-04-29
CVE-2026-42519 [MEDIUM] CWE-862 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Jenkins Script Security Plugin versions 1399.ve6a_66547f6e1 and earlier do not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to enumerate pending and approved Script Security classpaths.
VulDB
Jenkins Script Security Plugin up to 1399.ve6a_66547f6e1 permission (Nessus ID 310885)
vuldb·2026-04-29·CVSS 4.3
CVE-2026-42519 [MEDIUM] Jenkins Script Security Plugin up to 1399.ve6a_66547f6e1 permission (Nessus ID 310885)
A vulnerability classified as critical has been found in Jenkins Script Security Plugin up to 1399.ve6a_66547f6e1. This impacts an unknown function. The manipulation leads to permission issues.
This vulnerability is traded as CVE-2026-42519. It is possible to initiate the attack remotely. There is no exploit available.
Jenkins
Jenkins Security Advisory 2026-04-29
vendor_jenkins·2026-04-29·CVSS 4.3
CVE-2026-42519 [MEDIUM] Jenkins Security Advisory 2026-04-29
Title: Jenkins Security Advisory 2026-04-29
Jenkins Security Advisory 2026-04-29
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Credentials Binding
Plugin
GitHub
Plugin
GitHub Branch Source
Plugin
HTML Publisher
Plugin
Matrix Authorization Strategy
Plugin
Microsoft Entra ID (previously Azure AD)
Red Hat
Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via missing permission check
vendor_redhat·2026-04-29·CVSS 4.3
CVE-2026-42519 [MEDIUM] CWE-425 Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via missing permission check
Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via missing permission check
A flaw was found in Jenkins Script Security Plugin. An attacker with Overall/Read permission can exploit a missing permission check to enumerate pending and approved Script Security classpaths. This information disclosure vulnerability allows unauthorized access to sensitive configuration details within the Jenkins environment.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: jenkins (OpenShift Developer Tools and Services) - Fix deferred
Package: jenkins-2-plugins (Op
No detection rules found.
No public exploits indexed.
2026-04-29
Published