CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-57281
https://bugzilla.redhat.com/show_bug.cgi?id=2492200
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*

History

30 Jun 2026, 03:21

Type	Values Removed	Values Added
References		() https://access.redhat.com/security/cve/CVE-2026-57281 - () https://bugzilla.redhat.com/show_bug.cgi?id=2492200 - () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json -
CWE		CWE-917

27 Jun 2026, 19:27

Type	Values Removed	Values Added
References	~~() https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793 -~~	() https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793 - Vendor Advisory
First Time		Jenkins Jenkins script Security
CPE		cpe:2.3:a:jenkins:script_security::::::jenkins::*

24 Jun 2026, 15:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-693 CWE-93

24 Jun 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-24 14:17

Updated : 2026-07-15 01:16

NVD link : CVE-2026-57281

Mitre link : CVE-2026-57281

CVE.ORG link : CVE-2026-57281

JSON object : View

Products Affected

jenkins

script_security

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-693

Protection Mechanism Failure

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-57281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57281", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T13:56:13.318314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins Script Security Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1402.v94c9ce464861"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:ocp_tools"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services", "packageName": "jenkins", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services", "packageName": "jenkins-2-plugins", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services", "packageName": "ocp-tools-4/jenkins-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services", "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-24T14:17:34.023", "references": [{"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-57281", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-693"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script."}], "lastModified": "2026-07-15T01:16:38.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "3B2A92D1-EE7D-464B-954E-2CB5586A30D8", "versionEndIncluding": "1402.v94c9ce464861"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}