Jenkins Multijob Plugin: Groovy features skip Script Security, giving job configurers controller RCE

Impact

The plugin exposes Groovy scripting that never goes through the Script Security Plugin, so scripts run unsandboxed and without administrator approval. A user with only Item/Create or Item/Configure - a normal pipeline author, not an admin - executes arbitrary code in the Jenkins controller JVM. That collapses the boundary between people who may define builds and people who administer the CI system: on a GPU fleet the controller typically holds registry push credentials, cluster kubeconfigs and cloud tokens used to schedule jobs onto accelerator nodes. Only installations that actually run the Multijob Plugin are affected.

Who can reach it

An authenticated Jenkins user holding Item/Create or Item/Configure on any job, reachable over the normal web UI or API. No administrator rights and no agent access needed.

What to do

The record names Multijob Plugin 669.v9d96a_d9c71b_0 and earlier as affected and does not state a fixed release - check the Jenkins 2026-08-05 advisory (SECURITY-3823) before scheduling work, since Jenkins frequently publishes plugin issues with no fix available. Interim mitigation is to remove the plugin or withdraw Item/Create and Item/Configure from users who should not have controller-level code execution. Installing or removing a plugin requires a controller JVM restart, which aborts running builds.

References

Related entries

• Jenkins Multijob Plugin: CSRF lets an attacker run code in the Jenkins controller JVMCVE-2026-70432 · Jenkins Multijob Plugin (CSRF on code-executing endpoint)High
• Linux octeontx2-af (Marvell OCTEON CN10K, LMTLINE mailbox handler): The OCTEON CN10K admin-function mailbox handlerCVE-2026-72045 · Linux octeontx2-af (Marvell OCTEON CN10K, LMTLINE mailbox handler)High
• Linux octeontx2-af (VF clobbering shared CGX PKIND state): PF and VF NIX logical functions that share a CGX MAC reuseCVE-2026-74527 · Linux octeontx2-af (VF clobbering shared CGX PKIND state)High
• SkyPilot (API server, service account role update authorization): SkyPilot never checks whether the caller is entitledCVE-2026-75481 · SkyPilot (API server, service account role update authorization)High
• Citrix NetScaler ADC/Gateway: memory overflow in Gateway and AAA vservers causes denial of serviceCVE-2026-8452 · Citrix NetScaler ADC / Gateway (Gateway and AAA virtual servers)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High