CVE-2026-84659
published 2026-09-02CVE-2026-84659: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.28%
20.4th percentile
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | allure | — | — |
| jenkins | allure_plugin | — | — |
| jenkins | build_step | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | customizable_header | — | — |
| jenkins | customizable_header_plugin | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the_plugin | — | — |
| jenkins | file_parameter | — | — |
| jenkins | file_parameter_plugin | — | — |
| jenkins | gitlab | — | — |
| jenkins | gitlab_plugin | — | — |
| jenkins | groovy_libraries | — | — |
| jenkins | groovy_libraries_plugin | — | — |
| jenkins | ids_in_xebialabs_xl_deploy | — | — |
| jenkins | ids_in_xebialabs_xl_deploy_plugin | — | — |
| jenkins | improper_access_control_in_customizable_header | — | — |
| jenkins | improper_access_control_in_customizable_header_plugin | — | — |
| jenkins | improper_access_control_in_ldap | — | — |
| jenkins | improper_access_control_in_ldap_plugin | — | — |
| jenkins | improper_access_control_in_saml | — | — |
| jenkins | improper_access_control_in_saml_plugin | — | — |
| jenkins | improper_access_control_in_thinbackup | — | — |
| jenkins | improper_access_control_in_thinbackup_plugin | — | — |
| jenkins | jenkins | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Jenkins Project Script Security Plugin up to 1412.v7737b_3405f86 Permission Check privileges management
vuldb·2026-09-02·CVSS 4.3
CVE-2026-84659 [MEDIUM] Jenkins Project Script Security Plugin up to 1412.v7737b_3405f86 Permission Check privileges management
A vulnerability labeled as critical has been found in Jenkins Project Script Security Plugin up to 1412.v7737b_3405f86. Affected by this issue is some unknown functionality of the component Permission Check. Executing a manipulation can lead to improper privilege management.
This vulnerability is tracked as CVE-2026-84659. The attack can be launched remotely. No exploit exists.
GHSA
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowi
ghsa_unreviewed·2026-09-02
CVE-2026-84659 [MEDIUM] CWE-862 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowi
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
Red Hat
jenkins-script-security-plugin: Jenkins Script Security Plugin: Security sandbox bypass via missing permission check
vendor_redhat·2026-09-02·CVSS 4.3
CVE-2026-84659 [MEDIUM] CWE-425 jenkins-script-security-plugin: Jenkins Script Security Plugin: Security sandbox bypass via missing permission check
jenkins-script-security-plugin: Jenkins Script Security Plugin: Security sandbox bypass via missing permission check
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially compromising the Jenkins system.
Statement: A missing permission check flaw was found in the Jenkins Script Security Plugin. An authen
Jenkins
Jenkins Security Advisory 2026-09-02
vendor_jenkins·2026-09-02·CVSS 8.8
CVE-2026-84645 [HIGH] Jenkins Security Advisory 2026-09-02
Title: Jenkins Security Advisory 2026-09-02
Jenkins Security Advisory 2026-09-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Allure
Plugin
Customizable Header
Plugin
File Parameter
Plugin
GitLab
Plugin
Job Configuration History
Plugin
LDAP
Plugin
Microsoft Entra ID (previ
No detection rules found.
No public exploits indexed.
2026-09-02
Published