CVE-2026-57281
published 2026-06-24CVE-2026-57281: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing…
PriorityP350high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.92%
60.1th percentile
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | active_directory | — | — |
| jenkins | active_directory_plugin | — | — |
| jenkins | assembla | — | — |
| jenkins | assembla_plugin | — | — |
| jenkins | bitbucket_push_and_pull_request | — | — |
| jenkins | bitbucket_push_and_pull_request_plugin | — | — |
| jenkins | contrast_continuous_application_security | — | — |
| jenkins | contrast_continuous_application_security_plugin | — | — |
| jenkins | ec2_fleet | — | — |
| jenkins | ec2_fleet_plugin | — | — |
| jenkins | external_workspace_manager | — | — |
| jenkins | external_workspace_manager_plugin | — | — |
| jenkins | fitnesse | — | — |
| jenkins | fitnesse_plugin | — | — |
| jenkins | git_client | — | — |
| jenkins | git_client_plugin | — | — |
| jenkins | git_parameter | — | — |
| jenkins | git_parameter_plugin | — | — |
| jenkins | gitee | — | — |
| jenkins | gitee_plugin | — | — |
| jenkins | github_branch_source | — | — |
| jenkins | github_branch_source_plugin | — | — |
| jenkins | groovy | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | jenkins | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scrip
ghsa_unreviewed·2026-06-24
CVE-2026-57281 [HIGH] CWE-93 Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scrip
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
GHSA
Jenkins Script Security Plugin has a script security bypass vulnerability
ghsa·2026-06-24
CVE-2026-57281 [HIGH] CWE-917 Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.
This may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.
The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is d
Red Hat
jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox
vendor_redhat·2026-06-24·CVSS 7.5
CVE-2026-57281 [HIGH] CWE-917 jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox
jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
Statement: This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit imprope
Jenkins
Jenkins Security Advisory 2026-06-24
vendor_jenkins·2026-06-24
CVE-2026-57280 [HIGH] Jenkins Security Advisory 2026-06-24
Title: Jenkins Security Advisory 2026-06-24
Jenkins Security Advisory 2026-06-24
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Active Directory
Plugin
Assembla
Plugin
Bitbucket Push and Pull Request
Plugin
Contrast Continuous Application Security
Plugin
EC2 Fleet
Plugin
External Workspace Manag
No detection rules found.
No public exploits indexed.
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793https://access.redhat.com/errata/RHSA-2026:60239https://access.redhat.com/errata/RHSA-2026:60246https://access.redhat.com/errata/RHSA-2026:60247https://access.redhat.com/errata/RHSA-2026:60248https://access.redhat.com/errata/RHSA-2026:60249https://access.redhat.com/errata/RHSA-2026:60250https://access.redhat.com/errata/RHSA-2026:60251https://access.redhat.com/errata/RHSA-2026:60252https://access.redhat.com/errata/RHSA-2026:60254https://access.redhat.com/errata/RHSA-2026:60256https://access.redhat.com/errata/RHSA-2026:60259https://access.redhat.com/security/cve/CVE-2026-57281https://bugzilla.redhat.com/show_bug.cgi?id=2492200https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json
2026-06-24
Published