Vulnerability details
CVE-2026-57281
Jenkins Project Jenkins Script Security PluginRed Hat OpenShift Developer Tools and Services
CVSS 3.1
8.5High
Official description
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 8.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | v ≤ 1402.v94c9ce464861 | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Developer Tools and Services | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Developer Tools and Services | All | CVEProject cvelistV5 (CNA) |
References and advisories
15- https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-57281 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2492200 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:60247 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60249 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60248 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60239 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60251 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60246 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60250 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60252 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60259 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60254 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60256 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-24
- Last updated
- 2026-09-07
- State
- Published
- Assigner (CNA)
- jenkins
Exploit prediction (EPSS)
0.92%
Probability of exploitation in 30 days
60.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-693Protection Mechanism Failure
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')