CVE-2026-84658: Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Script Security Pluginto a version that resolves this vulnerability.Fixed in 1412.v7737b_3405f86 - Compensating control
Restrict access to any Jenkins pages/forms that allow attackers to submit the relevant forms capable of triggering script approval configuration reads, limiting who can reach those endpoints.
Event History
Frequently Asked Questions
Which installations are in the affected version range?
Jenkins installations using Script Security Plugin version 1412.v7737b_3405f86 or earlier are affected.
What access would an attacker need to exploit this issue?
An attacker must be able to submit certain forms. Successful exploitation allows them to read the script approval configuration.