CVE-2026-57281: Jenkins Script Security Plugin Sandbox Escape (CVSS 7.5)

Technical summary

The vulnerability exists in the Script Security Plugin's handling of Groovy Abstract Syntax Tree (AST) transformation annotations. Groovy's AST transformations allow compile-time metaprogramming, and annotations with an 'extensions' member can specify custom transformation classes. The plugin's sandbox implementation does not properly restrict these annotations, permitting an authenticated attacker to reference transformation classes that, when instantiated during script compilation, can execute arbitrary code outside the sandbox. The flaw maps to improper validation of code transformations (CWE-917) and insufficient input sanitization (CWE-93), combined with inadequate restriction of powerful language features (CWE-693). Exploitation requires both script submission privileges and the presence of a suitable gadget class on the classpath.

Business impact

For organizations using Jenkins with the Script Security Plugin as a multi-tenant or user-scripting platform, this vulnerability creates a privilege escalation and code execution risk. Developers or operators with legitimate script-execution permissions (e.g., job creators, pipeline authors) can escalate to unauthenticated command execution on the Jenkins controller or agent machines. This compromises the confidentiality, integrity, and availability of Jenkins-managed infrastructure, CI/CD artifacts, and downstream deployments. The blast radius extends to any system Jenkins can reach, making this a potential pivot point for lateral movement in the broader network.

Affected systems

Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier are affected. Any Jenkins instance with this plugin installed and configured to execute user-supplied or dynamically-generated Groovy scripts is at risk. This includes Jenkins deployments using declarative or scripted pipelines that allow developers to contribute code, shared library scripts, or custom job configurations. The vulnerability requires the attacker to already have Jenkins access and the ability to create or modify jobs/scripts, limiting the immediate exposure to insider threats or compromised developer accounts.

Exploitability

Exploitation requires authenticated access to Jenkins and the ability to execute Groovy scripts through the Script Security Plugin. The CVSS vector (AC:H, PR:L) reflects that while an attacker must have Low privilege (existing Jenkins user), the Attack Complexity is High—successful exploitation depends on identifying and leveraging a suitable gadget class present in the runtime classpath. The vulnerability is not publicly exploited at scale, and no exploit has been added to the CISA Known Exploited Vulnerabilities catalog. However, for Jenkins instances allowing untrusted script submissions, the bar for exploitation by an insider or compromised account is reasonable, particularly in mature Java environments where gadget chains are common.

Remediation

Upgrade the Jenkins Script Security Plugin to a patched version that properly validates and rejects AST transformation annotations carrying an extensions member. Check the Jenkins security advisory and plugin release notes to identify the specific fixed version. For environments unable to patch immediately, restrict job creation and script modification permissions to highly-trusted users, disable user-defined pipelines where feasible, and monitor script execution logs for suspicious AST annotation usage. Consider running Jenkins with minimal classpath exposure by removing unnecessary libraries that could serve as gadget classes.

Patch guidance

Consult the official Jenkins security advisory and the Script Security Plugin repository for the patched version released after 1402.v94c9ce464861. Update through the Jenkins Plugin Manager or by downloading the updated plugin directly from the Jenkins Update Center. Verify that the plugin version string and release notes confirm the AST annotation validation fix. Test the patch in a non-production environment first, as plugin updates can affect existing scripts or job configurations. Restart Jenkins or reload plugins after installation.

Detection guidance

Monitor Jenkins logs for script compilation errors or warnings related to AST transformations, particularly those mentioning 'extensions' members or annotation processing failures. Use Jenkins Script Console audit logs to identify scripts that attempt to import or reference transformation classes, especially in less common packages. Security scanning tools that analyze Groovy/Java code can detect patterns like @Grab or custom @Delegate annotations targeting suspicious classes. Implement network monitoring to detect unusual outbound connections from Jenkins processes that might indicate successful sandbox escape. Review job and pipeline configurations for embedded Groovy code using git history tools if Jenkins is version-controlled.

Why prioritize this

This vulnerability merits prioritization due to its HIGH CVSS score (7.5), the high impact of successful exploitation (complete code execution), and the likelihood of exploitation in organizations with active Jenkins developers or automation teams. Although the Known Exploited Vulnerabilities catalog has not tracked this yet, the attack surface exists wherever Jenkins permits script authoring. Patching is the primary mitigation and should be completed within your normal patching cadence, prioritized above routine updates but behind any active 0-day threats.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high impact (Confidentiality, Integrity, and Availability all rated High) tempered by the requirement for Low privilege and High attack complexity. The attacker must be an authenticated Jenkins user and must identify or prepare a gadget class, reducing the attack ease. The scope is Unchanged, meaning the vulnerability does not cross privilege boundaries beyond what the attacker already has. However, the practical impact—arbitrary code execution on the Jenkins controller—justifies the elevated score and warrants rapid remediation in production environments.

Frequently asked questions