CVE-2019-1003002: Jenkins Pipeline Declarative Plugin sandbox bypass enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with a very high EPSS score and public exploit code, though exploitation requires an authenticated Overall/Read account.

What it is

The Pipeline: Declarative Plugin (1.3.3 and earlier) fails to properly sandbox pipeline scripts parsed by Converter.groovy, letting a user with only Overall/Read permission submit a crafted pipeline script to an HTTP endpoint. Because the sandbox is bypassed, that low-privileged user can execute arbitrary code on the Jenkins master JVM.

Impact

An attacker gains arbitrary code execution on the Jenkins master JVM, which typically means full control of the CI server, its credentials, build jobs and connected agents.

Attack surface

Reached over the network via an HTTP endpoint that accepts pipeline scripts; the attacker needs only Overall/Read permission and no user interaction, per the CVSS vector AV:N/AC:L/PR:L/UI:N.

Exploitation

Not listed in CISA KEV, but public exploit code exists (ExploitDB 46572, Packet Storm, Rapid7 module) and EPSS is very high at 0.814 (99.6th percentile), indicating active exploitation is likely.

What to do

• Upgrade the Pipeline: Declarative Plugin to a version later than 1.3.3, or apply the vendor fix referenced in Jenkins advisory SECURITY-1266.
• Apply the Red Hat errata RHBA-2019:0326 and RHBA-2019:0327 for OpenShift Container Platform deployments.
• Restrict and audit who holds Overall/Read permission, since that is the only privilege required to exploit this flaw.
• Where feasible, run Jenkins masters with least privilege and isolate them from sensitive networks and credentials.

Detection

• Monitor Jenkins HTTP access logs for requests to pipeline script endpoints from accounts that normally do not submit pipelines.
• Alert on unexpected child processes or outbound connections spawned by the Jenkins master JVM.
• Review Jenkins audit logs for changes to pipeline jobs or scripts made by low-privileged users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.