CVE-2019-1003000: Jenkins Script Security Plugin sandbox bypass allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives authenticated low-privilege users remote code execution on the Jenkins master, and public exploit code plus a very high EPSS score make exploitation likely despite no KEV listing.

What it is

The Jenkins Script Security Plugin 1.49 and earlier fails to properly restrict Groovy sandboxed scripts in GroovySandbox.java, letting a user who can supply a sandboxed script break out of the sandbox. Because Jenkins scripts are commonly used in build pipelines, this flaw undermines the isolation that is supposed to keep untrusted script authors from touching the Jenkins master.

Impact

An attacker with the ability to provide sandboxed scripts can execute arbitrary code on the Jenkins master JVM, gaining full control of the Jenkins controller and any credentials or jobs it holds.

Attack surface

Reached over the network through Jenkins script submission paths such as build pipeline or script console features; the CVSS vector indicates low privileges are required and no user interaction.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.98375, 99.9th percentile) and multiple references are tagged Exploit, including Exploit-DB and a Rapid7 Metasploit module, so public exploit code exists.

What to do

• Upgrade the Jenkins Script Security Plugin to a version later than 1.49, following the vendor advisory SECURITY-1266.
• Apply the Red Hat errata RHBA-2019:0326 and RHBA-2019:0327 for OpenShift Container Platform deployments that bundle the affected plugin.
• Restrict who can submit scripts or use the script console, and review Jenkins authorization settings to limit low-privilege script access.
• If immediate upgrade is not possible, disable or tightly gate script-based features and monitor for unexpected Groovy execution.

Detection

• Monitor Jenkins logs for script console or pipeline script submissions from unexpected users or IPs.
• Alert on child processes spawned by the Jenkins master JVM, especially shells or interpreters not normally used by builds.
• Watch for outbound connections from the Jenkins controller to unfamiliar hosts that could indicate post-exploitation activity.
• Audit Jenkins user accounts and API tokens for newly created or modified privileged accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.