CVE-2019-1003030: Jenkins Pipeline Groovy Plugin sandbox bypass allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.9, confirmed exploitation via CISA KEV, and an EPSS probability above 0.96 make this an urgent patch target.

What it is

The Jenkins Pipeline: Groovy Plugin (2.63 and earlier) contains a sandbox bypass in CpsGroovyShell.java. Attackers who can control pipeline scripts can escape the Groovy sandbox and run arbitrary code on the Jenkins master JVM. Because Jenkins masters often hold credentials and deployment keys, this is a high-value target.

Impact

An attacker gains arbitrary code execution on the Jenkins master JVM, enabling theft of credentials, secrets and build artifacts, and lateral movement into connected systems. The scope change in the CVSS vector reflects impact beyond the vulnerable component.

Attack surface

Reachable over the network via the Jenkins interface by a user with low privileges who can supply or influence pipeline scripts; no user interaction is required. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:C.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-25, and EPSS shows a 30-day probability of 0.96868 (99.886th percentile). Public exploit code is referenced (Packet Storm), so exploitation is confirmed and widespread.

What to do

• Upgrade Jenkins Pipeline: Groovy Plugin to a version later than 2.63 per the Jenkins security advisory.
• Apply the Red Hat errata RHSA-2019:0739 for OpenShift Container Platform where applicable.
• Restrict who can create or modify pipeline scripts and review existing pipeline definitions for untrusted content.
• Run Jenkins masters with least privilege and isolate them from sensitive networks and credentials.

Detection

• Monitor Jenkins logs for Groovy sandbox rejection messages or unexpected script execution errors.
• Alert on new or modified pipeline scripts, especially those using reflection or classloader manipulation.
• Watch for outbound network connections or child processes spawned by the Jenkins master JVM.
• Audit Jenkins user accounts and API tokens for unexpected creation or privilege changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.