CVE-2026-57280: Jenkins Script Security Plugin sandbox bypass via Groovy implicit type casts

CVE-2026-57280 · Severity: high · CVSS 8.8 · Published 2026-06-24

The Jenkins Script Security Plugin is a tool used to safely run user-provided scripts by restricting them to a 'sandbox' environment. A vulnerability in this plugin allows an attacker with the ability to provide scripts (such as in a Pipeline) to bypass these safety restrictions. By exploiting this flaw, an attacker can execute unauthorized commands on the Jenkins controller, potentially leading to a full system takeover and access to sensitive build data.

Technologies: org.jenkins-ci.plugins:script-security (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-57280 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57280 being exploited in the wild.
How severe is CVE-2026-57280?
High severity, with a CVSS score of 8.8, published 24 June 2026.
Which products and versions are affected?
org.jenkins-ci.plugins:script-security (Maven) < 1402.1405.vc96e74964250, ECOSYSTEM:introduced=0,fixed=1402.1405.vc96e74964250.
Is there a fix for CVE-2026-57280?
Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57280 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57280?
Check whether you run org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later
    # set org.jenkins-ci.plugins:script-security to 1402.1405.vc96e74964250 in your pom.xml or build.gradle

Technical details

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin due to improper interception of implicit type casts. In sandboxed Groovy scripts, typed for-each loops (e.g., 'for (Type t in collection)') perform type casting during bytecode generation rather than in the transformed Abstract Syntax Tree (AST). Because the plugin failed to intercept these specific casts, an attacker can craft a script that invokes arbitrary constructors. This bypasses the sandbox's security checks, allowing for arbitrary code execution on the Jenkins controller. The issue is resolved in version 1402.1405.vc96e74964250 by updating the groovy-sandbox library.

Affected products

  • Jenkins Project Script Security Plugin 1402.v94c9ce464861 and earlier

Identifiers

  • CVE-2026-57280
  • GHSA-c3jm-9vj7-5v66

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory
  • 2026-06-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.