CVE-2026-84659

No fix known EPSS <1%CVSS 4.3

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

Published 2026-09-02 · CVE record · OSV

Products: Jenkins project Jenkins Script Security Plugin