Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

published 2026-04-29 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-26220 , GHSA-p334-gfhq-c7w6

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.

Patch / fix

fixed in 3

maven org.jenkins-ci.plugins:script-security 1402.v94c9ce464861
jenkins script_security 1402.v94c9ce464861
org.jenkins-ci.plugins script-security 1402.v94c9ce464861

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42519 updated 2026-06-28 cvss 6.5

Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via missing permission check

Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel8, ocp-tools-4/jenkins-agent-base-rhel9
affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-29)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.plugins:script-security	<1402.v94c9ce464861	1402.v94c9ce464861

Affected products

Jenkins Project Jenkins Script Security Plugin

Classification

Weakness

CWE-862 Missing Authorization

References

jenkins.io /security/advisory/2026-04-29/#SECURITY-3662
vendor-advisory, web
nvd.nist.gov /vuln/detail/CVE-2026-42519
advisory
github.com /jenkinsci/script-security-plugin
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary