# CVE-2026-57280: Jenkins Script Security Plugin sandbox bypass via Groovy implicit type casts

Source: https://junglewise.ai/threats/cve-2026-57280-jenkins-script-security-plugin-sandbox-bypass-via-groovy-implicit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-57280 · Severity: high · CVSS 8.8 · Published 2026-06-24

The Jenkins Script Security Plugin is a tool used to safely run user-provided scripts by restricting them to a 'sandbox' environment. A vulnerability in this plugin allows an attacker with the ability to provide scripts (such as in a Pipeline) to bypass these safety restrictions. By exploiting this flaw, an attacker can execute unauthorized commands on the Jenkins controller, potentially leading to a full system takeover and access to sensitive build data.

Technologies: [org.jenkins-ci.plugins:script-security (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-script-security). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-57280 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57280 being exploited in the wild.

**How severe is CVE-2026-57280?** High severity, with a CVSS score of 8.8, published 24 June 2026.

**Which products and versions are affected?** org.jenkins-ci.plugins:script-security (Maven) < 1402.1405.vc96e74964250, ECOSYSTEM:introduced=0,fixed=1402.1405.vc96e74964250.

**Is there a fix for CVE-2026-57280?** Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57280 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57280?** Check whether you run org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later

  ```sh
  # set org.jenkins-ci.plugins:script-security to 1402.1405.vc96e74964250 in your pom.xml or build.gradle
  ```


## Technical details

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin due to improper interception of implicit type casts. In sandboxed Groovy scripts, typed for-each loops (e.g., 'for (Type t in collection)') perform type casting during bytecode generation rather than in the transformed Abstract Syntax Tree (AST). Because the plugin failed to intercept these specific casts, an attacker can craft a script that invokes arbitrary constructors. This bypasses the sandbox's security checks, allowing for arbitrary code execution on the Jenkins controller. The issue is resolved in version 1402.1405.vc96e74964250 by updating the groovy-sandbox library.

## Affected products

- Jenkins Project Script Security Plugin 1402.v94c9ce464861 and earlier

## Identifiers

- CVE-2026-57280
- GHSA-c3jm-9vj7-5v66

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched

## References

- [https://www.jenkins.io/security/advisory/2026-06-24/](https://www.jenkins.io/security/advisory/2026-06-24/)

## Related threats

- [Jenkins Script Security Plugin sandbox bypass via Groovy AST annotations](https://junglewise.ai/threats/cve-2026-57281-jenkins-script-security-plugin-sandbox-bypass-via-groovy-ast)
- [Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths](https://junglewise.ai/threats/cve-2026-42519-jenkins-script-security-plugin-missing-permission-checks-allow)
- [Missing permission check in Jenkins Script Security Plugin](https://junglewise.ai/threats/cve-2024-52549-missing-permission-check-in-jenkins-script-security-plugin)
- [Jenkins Script Security Plugin sandbox bypass vulnerability](https://junglewise.ai/threats/cve-2024-34145-jenkins-script-security-plugin-sandbox-bypass-vulnerability)
- [Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies](https://junglewise.ai/threats/cve-2024-34144-jenkins-script-security-plugin-has-sandbox-bypass-vulnerability)