Jenkins Script Security Plugin: sandbox bypass via implicit casts in typed for-each loops

Impact

The plugin up to 1402.v94c9ce464861 does not intercept the implicit type casts applied to elements of typed for-each loops in sandboxed Groovy, letting a script invoke arbitrary constructors and escape the sandbox. The sandbox is the control that lets a Jenkins controller accept pipeline scripts from people who are not administrators, so breaking it converts job-level script submission into code execution on the controller. A Jenkins controller that builds and signs the images a GPU fleet runs holds registry push credentials, cloud and Kubernetes tokens and signing keys - compromise there reaches the fleet through the deploy path rather than through any GPU node directly.

Who can reach it

Any user who can supply a sandboxed Groovy script to the controller - commonly a developer with job configure or pipeline edit rights. Authentication to Jenkins is required; administrator rights are not.

What to do

Update the Script Security Plugin past 1402.v94c9ce464861 per the 2026-06-24 Jenkins advisory, which requires restarting the Jenkins controller - a short maintenance window that aborts or queues running builds. Until then, restrict who may submit or edit pipeline scripts, since the sandbox cannot be relied on as a boundary.

References

Related entries

• Jenkins External Workspace Manager: path traversal in exwsAllocate reads any controller fileCVE-2026-57296 · Jenkins External Workspace Manager Plugin (exwsAllocate Pipeline step)High
• Jenkins OWASP ZAP Plugin: build operations run on the controller, giving Item/Configure users code executionCVE-2026-57301 · Jenkins OWASP ZAP Plugin (build steps executed on the controller instead of the agent)High
• Apache Airflow: executor_config deserialization imports arbitrary callables in scheduler and API serverCVE-2026-58076 · Apache Airflow serialization layer (exception branch reached via operator executor_config)High
• rclone (serve restic --private-repos): --private-repos is meant to confine each authenticated user to their ownCVE-2026-59733 · rclone (serve restic --private-repos)High
• Red Hat ACM: ManagedClusterAddOn annotation overrides governance-policy image, giving cluster-admin execCVE-2026-66793 · Red Hat Advanced Cluster Management governance-policy-addon-controllerHigh
• Apache Airflow: Callback deserialization in the scheduler timeout sweep imports Dag-author-chosen modulesCVE-2026-67587 · Apache Airflow Task SDK Callback deserialization (task instance next_kwargs)High