CVE-2026-42519 Overview
A missing permission check vulnerability exists in Jenkins Script Security Plugin version 1399.ve6a_66547f6e1 and earlier. This security flaw allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths, potentially exposing sensitive configuration information about the Jenkins environment.
Critical Impact
Attackers with basic read access can enumerate Script Security classpaths, revealing approved scripts and pending approvals that could aid in further attacks against the Jenkins infrastructure.
Affected Products
- Jenkins Script Security Plugin version 1399.ve6a_66547f6e1 and earlier
Discovery Timeline
- 2026-04-29 - CVE CVE-2026-42519 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-42519
Vulnerability Analysis
This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the affected component fails to perform adequate permission verification before allowing access to sensitive functionality. The Jenkins Script Security Plugin is designed to provide sandboxed script execution and maintain a list of approved classpaths. However, a missing permission check allows users with minimal privileges to access information they should not be authorized to view.
The flaw enables information disclosure through the enumeration of Script Security classpaths. An attacker with only Overall/Read permission—a relatively low-privilege access level in Jenkins—can discover both pending and approved classpath entries. This information could be leveraged to understand the security posture of the Jenkins instance, identify potential attack surfaces, or craft more targeted exploitation attempts.
Root Cause
The root cause is a missing authorization check in the Jenkins Script Security Plugin. The plugin fails to verify that users have appropriate permissions before exposing classpath enumeration functionality. While users are required to have Overall/Read permission, this check is insufficient for operations that should require elevated privileges such as Overall/Administer.
Attack Vector
The attack is network-based and requires low complexity to execute. An authenticated attacker with Overall/Read permission can access the vulnerable endpoint without any user interaction. The attacker can enumerate:
- Pending Script Security classpath approvals
- Already approved Script Security classpaths
This enumeration capability allows reconnaissance of the Jenkins security configuration, potentially revealing custom scripts, libraries, and security policies in use. The vulnerability is exploitable through normal Jenkins API or web interface interactions by authenticated users.
Detection Methods for CVE-2026-42519
Indicators of Compromise
- Unusual access patterns to Script Security classpath enumeration endpoints by low-privilege users
- Increased API requests querying Script Security configuration from accounts with only Overall/Read permissions
- Audit logs showing repeated classpath enumeration attempts from unexpected user accounts
Detection Strategies
- Monitor Jenkins audit logs for access to Script Security Plugin administrative functions by non-administrator accounts
- Implement alerting for enumeration-style behavior patterns targeting security configuration endpoints
- Review Jenkins access logs for suspicious query patterns against the Script Security Plugin
Monitoring Recommendations
- Enable comprehensive audit logging in Jenkins to track all Script Security Plugin access
- Configure alerts for abnormal access patterns to plugin configuration endpoints
- Regularly review user permissions to ensure principle of least privilege is maintained
How to Mitigate CVE-2026-42519
Immediate Actions Required
- Update Jenkins Script Security Plugin to the latest patched version immediately
- Review and restrict Overall/Read permissions to only essential personnel
- Audit current user access to identify any potential unauthorized enumeration activity
- Consider temporarily restricting access to Jenkins while applying updates
Patch Information
Jenkins has released a security advisory addressing this vulnerability. Administrators should update the Script Security Plugin to the latest available version through the Jenkins Plugin Manager. For detailed patch information, refer to the Jenkins Security Advisory SECURITY-3662.
Workarounds
- Restrict Overall/Read permission to only trusted and necessary users pending patch application
- Implement network-level access controls to limit who can reach the Jenkins instance
- Monitor and log all access to Script Security Plugin endpoints for suspicious activity
- Consider placing Jenkins behind additional authentication layers to reduce exposure
# Review current plugin version in Jenkins
# Navigate to: Manage Jenkins > Plugin Manager > Installed
# Verify Script Security Plugin is updated beyond version 1399.ve6a_66547f6e1
# Alternatively, check via Jenkins CLI
java -jar jenkins-cli.jar -s http://your-jenkins-url/ list-plugins | grep script-security
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
