CVE-2026-57280 Jenkins Script Security Plugin sandbox bypass vulnerability
Attackers can bypass the Groovy sandbox in Jenkins Script Security Plugin to invoke arbitrary constructors and execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57280?
CVE-2026-57280 is a high-severity vulnerability in Jenkins Script Security Plugin, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
Weakness: CWE-693
Which versions are affected by CVE-2026-57280?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:script-security. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:script-security Maven | All versions | 1402.1405.vc96e74964250 |
org.jenkins-ci.plugins:script-security Maven | All versions | 1402.1405.vc96e74964250 |
Products include Jenkins Script Security.
How do I fix CVE-2026-57280?
Upgrade org.jenkins-ci.plugins:script-security to 1402.1405.vc96e74964250 or later.
Is CVE-2026-57280 being exploited?
There is no known exploitation of CVE-2026-57280 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Script Security Plugin
- CVE-2019-1003029 Jenkins Script Security Plugin Sandbox Bypass
- CVE-2022-43401 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
- CVE-2022-43403 Jenkins Script Security Plugin sandbox bypass vulnerability
- CVE-2022-43404 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
- CVE-2020-2279 Sandbox bypass vulnerability in Jenkins Script Security Plugin
Sources
Also known as GHSA-c3jm-9vj7-5v66, MINI-3f2f-qcqv-xg8r, MINI-937j-h7cg-733j, MINI-hj9x-xhvm-36f3, MINI-m66h-cv6m-fhrw, MINI-p5c5-x68v-cvxf and 2 more.