CVE-2019-10306: Sandbox bypass in ontrack Jenkins Plugin
Summary
CVE-2019-10306: Sandbox bypass in ontrack Jenkins Plugin. Affects org.jenkins-ci.plugins:ontrack versions < 3.4.1. Fixed in 3.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ontrack Jenkins Plugin is a Maven package that provides integration between Jenkins and the ontrack tool. It allows users to define and manage ontrack DSL definitions within Jenkins. The plugin enables seamless communication and coordination between the two tools, enhancing the automation and tracking capabilities of Jenkins.
Vulnerability Detail
A sandbox bypass vulnerability has been discovered in the ontrack Jenkins Plugin version 3.4 and earlier. This vulnerability allows attackers who have control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM. By exploiting this vulnerability, an attacker can gain unauthorized access to the Jenkins environment and potentially perform malicious actions, such as stealing sensitive information or disrupting the build process.
How To Fix
Latest published version: 4.1.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the ontrack Jenkins Plugin to the latest secure version as soon as possible.
Conclusion
The sandbox bypass vulnerability in the ontrack Jenkins Plugin poses a significant risk to Jenkins environments. It is crucial to update the plugin to version 3.4.1 or later to prevent unauthorized code execution and protect the integrity of the Jenkins master JVM. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ontrack →
FAQ
This vulnerability allows attackers to execute arbitrary code on the Jenkins master JVM, potentially leading to unauthorized access, data theft, or disruption of the build process.
Users of the ontrack Jenkins Plugin versions 3.4 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update to the latest secure version to mitigate the risk.
Yes, a fix is available in version 3.4.1 of the ontrack Jenkins Plugin. It is recommended to update to this version or later to address the vulnerability.
No, this vulnerability requires a software update to fix. Configuration changes alone cannot mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ontrack.
