Executive brief
The Jenkins Script Security Plugin, used to enforce approval controls on dangerous scripts within Jenkins automation servers, improperly allows form submissions to instantiate configuration objects. Attackers with read access can exploit this to read sensitive script approval configuration data that should be restricted, potentially bypassing script security controls.
Technical details
The Jenkins Script Security Plugin uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing Stapler form data binding to instantiate the configuration object from user-submitted forms. An attacker with Overall/Read permission can craft a form submission specifying the vulnerable constructor to instantiate and read the script approval configuration that would normally be restricted. The vulnerability requires network access and authenticated read-level permissions. Successful exploitation allows an attacker to read sensitive configuration data used to control script execution policies in Jenkins, potentially informing further attacks on script security controls.
Affected products
- Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: Jenkins Security Advisory 2026-09-02