CVE-2026-57280: High severity Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57280?
CVE-2026-57280 has a high severity rating of 8.8 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-57280?
To resolve CVE-2026-57280, you should update the Jenkins Script Security Plugin to version 1403 or later.
What impact does CVE-2026-57280 have on my Jenkins instance?
CVE-2026-57280 allows attackers to bypass sandbox protection and invoke arbitrary constructors in Groovy scripts, potentially compromising your Jenkins instance.
Can CVE-2026-57280 be exploited remotely?
Yes, CVE-2026-57280 can be exploited remotely since it affects Groovy scripts provided by attackers.
What versions of the Jenkins Script Security Plugin are affected by CVE-2026-57280?
CVE-2026-57280 affects Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier.