CVE-2026-84659: Jenkins Script Security Plugin Auth Bypass

CVE-2026-84659 Overview

CVE-2026-84659 is a missing authorization vulnerability in the Jenkins Script Security Plugin. Versions 1412.v7737b_3405f86 and earlier fail to enforce a permission check on the method controlling the "Force the use of the sandbox globally in the system" setting. Authenticated attackers can disable this global sandbox enforcement through Stapler data binding. Disabling the sandbox weakens script execution restrictions across the Jenkins controller. The flaw is classified as [CWE-862] Missing Authorization and requires low-privileged network access.

Critical Impact
Authenticated attackers with low privileges can disable the global sandbox enforcement in Jenkins, undermining a key defense-in-depth control for Groovy script execution.

Affected Products

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier
Jenkins controllers with the Script Security Plugin installed
Any Jenkins deployment relying on global sandbox enforcement for untrusted script authors

Discovery Timeline

2026-09-02 - CVE-2026-84659 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-3986 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84659

Vulnerability Analysis

The Script Security Plugin provides sandboxing for Groovy scripts executed within Jenkins. Administrators can enable a system-wide setting that forces all scripts to run inside the sandbox, regardless of author trust level. This setting is a critical defense-in-depth control against arbitrary code execution on the Jenkins controller.

The vulnerability stems from the absence of a permission check on the setter method that controls this configuration. Because Jenkins uses Stapler for HTTP request routing and data binding, form fields and request parameters are automatically bound to Java setters on exposed objects. An attacker who can reach the affected endpoint can submit a crafted request that flips the enforcement flag without holding administrator rights.

Once disabled, script authors who lack full Jenkins/Administer permissions may be able to submit scripts that escape sandbox restrictions, depending on the surrounding configuration. This transforms a lower-severity authorization gap into a stepping stone for broader compromise of the Jenkins environment.

Root Cause

The root cause is a missing permission check [CWE-862] on the method that toggles the "Force the use of the sandbox globally in the system" option. The method is exposed through Stapler data binding but does not call the expected permission enforcement helper before mutating state.

Attack Vector

Exploitation requires network access to the Jenkins web interface and any authenticated account with low privileges. The attacker submits an HTTP request that binds a parameter to the vulnerable setter, disabling global sandbox enforcement. No user interaction is required, and the request can be issued directly against the affected endpoint. Detailed technical information is available in the Jenkins Security Advisory SECURITY-3986.

Detection Methods for CVE-2026-84659

Indicators of Compromise

Unexpected changes to the global "Force sandbox" setting in Jenkins system configuration
Audit log entries showing configuration changes to Script Security Plugin state by non-administrative users
New or modified pipeline jobs containing Groovy scripts that would previously have required sandbox execution
HTTP POST requests to Script Security Plugin descriptor endpoints originating from low-privileged accounts

Detection Strategies

Compare the current value of the global sandbox enforcement setting against a known-good baseline
Alert on any state change to Script Security Plugin configuration outside of approved change windows
Review Jenkins access logs for requests to descriptor configuration endpoints from users without Administer permission
Inspect job build history for scripts approved or executed after any configuration change to the sandbox setting

Monitoring Recommendations

Forward Jenkins system, audit, and access logs to a centralized SIEM for correlation
Track the installed version of the Script Security Plugin across all Jenkins controllers
Monitor authentication events for low-privileged accounts performing configuration mutations
Establish alerts for privilege changes and plugin configuration updates on production Jenkins instances

How to Mitigate CVE-2026-84659

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to a version later than 1412.v7737b_3405f86 as noted in the Jenkins advisory
Verify the current state of the "Force the use of the sandbox globally in the system" setting and restore the expected value
Audit recent Jenkins configuration and job changes for unauthorized modifications
Restrict Jenkins account creation and review permission assignments for low-privileged users

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3986 for the fixed plugin version and upgrade guidance. Apply the update on all Jenkins controllers running the Script Security Plugin. After upgrading, confirm that the permission check is enforced by attempting the configuration change with a non-administrative test account.

Workarounds

Limit network access to the Jenkins web interface to trusted administrators until the plugin can be upgraded
Reduce the number of authenticated users who can reach the Jenkins controller
Periodically re-assert the desired value of the global sandbox setting through configuration-as-code
Review and tighten authorization strategy to minimize permissions granted to non-administrative users

bash

# Verify installed Script Security Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep script-security