CVE-2026-42519

What it actually does

Missing permission check allows users with Overall/Read permission to list pending and approved Script Security classpaths, exposing internal configuration details.

Why it matters to the business

Attackers can gather information about approved scripts and classpaths that may support follow-on attacks, increasing reconnaissance risk in CI/CD environments with broad read access.

How an attack unfolds

An attacker authenticates with Overall/Read permission and issues crafted API or UI requests to the Script Security plugin endpoints that enumerate classpaths without additional authorization checks.

How to fix it

Upgrade the Script Security Plugin to a version newer than 1399.ve6a_66547f6e1 once released; restrict Overall/Read permission to trusted users until the update is applied.

How to confirm the fix worked

Confirm plugin version exceeds 1399.ve6a_66547f6e1, verify that Overall/Read users can no longer access classpath enumeration endpoints, and review audit logs for unauthorized enumeration attempts.

Typical attack path

1. Obtain or compromise an account with Overall/Read permission
2. Identify Jenkins instance running vulnerable Script Security Plugin version
3. Send requests to classpath enumeration endpoints
4. Collect list of pending and approved classpaths for further targeting

How to detect it

Review Jenkins access logs and Script Security plugin logs for repeated or unexpected calls to classpath listing endpoints by accounts holding only Overall/Read permission.

What your security team should do

• Prioritize upgrade of Script Security Plugin as soon as a fixed release is available
• Audit and tighten Overall/Read permission assignments
• Monitor EPSS trend for increases in exploitation likelihood
• Enable detailed logging for Script Security plugin endpoints