Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-24T13:20:04 jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-1287

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.

Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority — a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. OpenShift Developer Tools and Services Affected jenkins OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-agent-base-rhel9 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-57280 https://nvd.nist.gov/vuln/detail/CVE-2026-57280 https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792