High severity · published Jun 24, 2026
CVE-2026-57281
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run…
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jenkins Script Security Plugin · Jenkins Project
through 1402.v94c9ce464861 · source: vendor
SS
Script Security · Jenkins
through 1402.v94c9ce464861 · source: NVD
OD
OpenShift Developer Tools and Services · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.12 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.13 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.14 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.15 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.16 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.17 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.18 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.19 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.20 · Red Hat
All versions, or not specified · source: CISA
Affected product
JS
Jenkins Script Security Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57281
Vendor Advisory
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60239
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60246
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60247
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60248
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:60249
More from Jenkins Script Security Plugin
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2022-43404
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451…
9.9
CVE-2022-43401
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier…
9.9
CVE-2022-43403
A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with…
8.8
CVE-2026-92125
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run…