CVE-2019-1003001: Jenkins Pipeline Groovy Plugin sandbox bypass allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw gives remote code execution on the Jenkins master to a low-privileged authenticated user and has public exploit code plus a very high EPSS score, though it is not in KEV.

What it is

The Pipeline: Groovy Plugin (2.61 and earlier) fails to properly sandbox pipeline scripts, letting a user with only Overall/Read permission submit a crafted script to an HTTP endpoint that escapes the Groovy sandbox. Because the flaw runs code in the Jenkins master JVM, a low-privileged account can compromise the controller itself.

Impact

An attacker gains arbitrary code execution on the Jenkins master JVM, which can lead to full control of the Jenkins controller, its credentials, and any jobs or agents it manages.

Attack surface

Reached over the network through an HTTP endpoint that accepts pipeline scripts; the attacker needs an authenticated account with Overall/Read permission and no user interaction is required.

Exploitation

Public exploit code exists (Packet Storm, Exploit-DB, and a Rapid7 Metasploit module), and EPSS is very high at 0.86 (99.7th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Pipeline: Groovy Plugin to a version later than 2.61 per the Jenkins security advisory SECURITY-1266.
• Apply the Red Hat errata RHBA-2019:0326 and RHBA-2019:0327 for OpenShift Container Platform deployments.
• Restrict Overall/Read and other Jenkins permissions to trusted users only, since the flaw requires only that permission.
• Where feasible, run Jenkins controllers with network access limited to trusted management networks and avoid exposing them to untrusted users.

Detection

• Review Jenkins audit logs for pipeline script submissions or HTTP requests to script-handling endpoints from accounts that normally do not build jobs.
• Monitor Jenkins master JVM processes for unexpected child processes or outbound connections that indicate post-exploitation activity.
• Search for known exploit artifacts or Metasploit module traffic (exploit/multi/http/jenkins_metaprogramming) against Jenkins endpoints.
• Alert on creation or modification of pipeline jobs by low-privileged accounts, especially those with Overall/Read only.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.