CVE-2026-84659 in Script Security Plugin
Summary
by MITRE • 09/02/2026
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins Script Security Plugin is a critical component for maintaining safe execution environments within continuous integration and deployment pipelines by restricting Groovy script execution to a controlled sandbox context. In versions 1412.v7737b_3405f86 and earlier, a significant security flaw exists in the configuration management logic that governs global sandbox enforcement settings. This vulnerability stems from an improper implementation of access control mechanisms within the Stapler framework integration used by Jenkins for handling HTTP requests and form submissions. Specifically, the method responsible for toggling the system-wide setting to force the use of the script sandbox does not perform adequate permission verification before processing state changes.
This architectural weakness allows authenticated users with lower privilege levels than administrators to manipulate this critical security configuration through Stapler data binding mechanisms. Stapler is a web framework that simplifies HTTP request handling in Jenkins, but when combined with insufficient authorization checks on specific administrative endpoints or settings handlers, it creates an avenue for unauthorized state modification. An attacker who has gained access to the Jenkins instance can exploit this flaw by sending crafted requests that bypass standard permission gates, effectively disabling the global sandbox enforcement without possessing the necessary admin privileges required for other configuration changes.
The operational impact of this vulnerability is severe because it undermines one of the primary defense mechanisms against arbitrary code execution within Jenkins pipelines. When the force-sandbox setting is disabled globally, all subsequent script executions are no longer constrained by the restrictive security policies defined in the Script Security plugin. This effectively grants any user with access to create or modify jobs the ability to execute unrestricted Groovy scripts on the controller node. Such unrestricted execution can lead to full system compromise, including data exfiltration, lateral movement within the network infrastructure, and potential denial of service through resource exhaustion or destructive commands.
This flaw aligns with Common Weakness Enumeration CWE-284, which describes Improper Access Control, as well as CWE-693, Protection Mechanism Failure, where a security mechanism intended to protect resources fails in its function. From an adversary perspective, this vulnerability facilitates privilege escalation and is consistent with MITRE ATT&CK technique T1078, Valid Accounts, specifically the aspect of using legitimate credentials to bypass security controls that should restrict their capabilities. The exploitation path leverages Stapler data binding, which relates to improper input validation and authorization checks in web application frameworks.
Mitigation strategies require immediate action by Jenkins administrators to update the Script Security Plugin to a version where this permission check has been properly enforced. Until an upgrade is feasible, organizations should review user roles and permissions within their Jenkins instances to ensure that only trusted administrative accounts have access to job configuration endpoints. Additionally, implementing network-level controls such as firewalls or reverse proxies can help restrict direct access to sensitive management interfaces from untrusted networks. Continuous monitoring of system logs for unusual changes in security settings is also recommended to detect potential exploitation attempts early and maintain the integrity of the CI/CD pipeline environment.