CVE-2026-57280: Jenkins Script Security Sandbox Bypass

CVE-2026-57280 Overview

CVE-2026-57280 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier. The plugin fails to intercept implicit type casts applied to elements of typed for-each loops in sandboxed Groovy scripts. Attackers who can submit such scripts can invoke arbitrary constructors and escape the Groovy sandbox. The flaw is classified as [CWE-693] Protection Mechanism Failure. Successful exploitation grants attackers code execution within the Jenkins controller process, putting builds, credentials, and connected agents at risk.

Critical Impact
Authenticated attackers with permission to define sandboxed Groovy scripts can bypass the sandbox, invoke arbitrary constructors, and execute code in the Jenkins controller context.

Affected Products

Jenkins Script Security Plugin 1402.v94c9ce464861
Jenkins Script Security Plugin versions earlier than 1402.v94c9ce464861
Jenkins controllers running pipelines that use sandboxed Groovy scripts

Discovery Timeline

2026-06-24 - Jenkins publishes Security Advisory SECURITY-3792
2026-06-24 - CVE-2026-57280 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57280

Vulnerability Analysis

The Jenkins Script Security Plugin enforces a Groovy sandbox that restricts which methods, constructors, and fields user-supplied scripts may invoke. The sandbox intercepts method calls and casts to ensure each invocation passes through an allowlist. The vulnerable versions miss one specific code path: implicit type casts performed on elements when iterating typed for-each loops.

When Groovy compiles a loop such as for (TargetType item : collection), it inserts an implicit cast from the collection element to TargetType. In affected releases this cast is not routed through the sandbox interceptor. An attacker can craft a TargetType whose constructor performs sensitive operations, then place a controlled value into the iterated collection. The runtime invokes the constructor without sandbox checks.

The outcome is arbitrary constructor invocation, which is the standard primitive for escaping the Groovy sandbox in Jenkins. From that primitive, attackers can pivot to arbitrary Java code execution inside the Jenkins controller JVM.

Root Cause

The root cause is incomplete coverage of Groovy's casting call sites. The interceptor inspects explicit casts and method calls but omits the synthetic cast emitted by the compiler for typed for-each iteration. This gap allows constructor invocation to occur outside the allowlist enforcement layer.

Attack Vector

Exploitation requires the ability to submit a sandboxed Groovy script. This typically maps to users with Item/Configure or pipeline submission permissions on a Jenkins instance. The attacker authors a pipeline or script that defines a malicious class and iterates a collection with that class as the declared element type. When Jenkins evaluates the script, the implicit cast triggers the constructor and the sandbox is bypassed. No user interaction beyond script execution is required.

No public proof-of-concept code is referenced in the advisory at the time of publication. Refer to the Jenkins Security Advisory 2026-06-24 for technical details.

Detection Methods for CVE-2026-57280

Indicators of Compromise

Unexpected Groovy scripts containing typed for-each loops (for (CustomType x : list)) submitted by non-administrator users.
New or modified pipeline definitions referencing unfamiliar classes whose constructors trigger reflection, process execution, or file I/O.
Jenkins controller spawning child processes such as sh, bash, cmd.exe, or java outside normal build agents.

Detection Strategies

Audit $JENKINS_HOME/jobs/*/config.xml and pipeline libraries for Groovy scripts that use typed iteration over attacker-controlled types.
Review Jenkins audit logs for ScriptApproval events and sandbox-related exceptions that precede successful script runs.
Monitor the installed plugin inventory and alert on Script Security Plugin versions at or below 1402.v94c9ce464861.

Monitoring Recommendations

Forward Jenkins controller logs and process telemetry to a central SIEM and alert on the java process spawning shells or network utilities.
Track outbound network connections from the Jenkins controller host, which should normally be limited to agents, source control, and artifact repositories.
Enable and review Jenkins Audit Trail plugin events for script submissions by low-privilege users.

How to Mitigate CVE-2026-57280

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to the fixed release published in the Jenkins Security Advisory 2026-06-24.
Restrict Overall/Administer, Item/Configure, and pipeline submission permissions to trusted users until patching is complete.
Review recently submitted scripts and pipeline changes for typed for-each constructs that could indicate exploitation attempts.

Patch Information

Jenkins addressed the issue in the Script Security Plugin update referenced in SECURITY-3792. The fix routes implicit casts generated for typed for-each loops through the sandbox interceptor so that constructor invocations are subject to the existing allowlist. Apply the update through the Jenkins Plugin Manager and restart the controller to load the patched classes.

Workarounds

Remove or disable the Script Security Plugin if sandboxed scripting is not required by any pipeline.
Limit script submission to administrators by tightening project-based matrix authorization on affected jobs.
Disable script approval for non-administrator users and require administrator review of all new Groovy scripts until the patch is applied.

bash

# List installed plugin version and confirm upgrade
jenkins-cli -s "$JENKINS_URL" list-plugins script-security

# Upgrade Script Security Plugin and restart the controller
jenkins-cli -s "$JENKINS_URL" install-plugin script-security -deploy
jenkins-cli -s "$JENKINS_URL" safe-restart