CVE-2019-16538: Incorrect Authorization in Jenkins Script Security Plugin
Summary
CVE-2019-16538: Incorrect Authorization in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.68. Fixed in 1.68. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandbox environment for executing scripts. It allows users to define and run custom scripts within Jenkins pipelines. The plugin is an essential part of Jenkins as it enables users to automate various tasks and customize their workflows. However, versions 1.67 and earlier of the plugin are vulnerable to an incorrect authorization issue, which can lead to the execution of arbitrary code in sandboxed scripts.
Vulnerability Detail
The vulnerability in the Jenkins Script Security Plugin arises from the mishandling of default parameter expressions in closures. This flaw allows attackers to bypass the sandbox environment and execute arbitrary code within scripts. By exploiting this vulnerability, an attacker with limited privileges can escalate their privileges and potentially gain unauthorized access to sensitive information or perform malicious actions. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.68
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading the Jenkins Script Security Plugin to the latest version.
Conclusion
The Jenkins Script Security Plugin version 1.67 and earlier are vulnerable to an incorrect authorization issue that allows for the execution of arbitrary code in sandboxed scripts. To address this vulnerability, it is crucial to upgrade the plugin to version 1.68 or later. Failure to do so may result in unauthorized access, data breaches, or other malicious activities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code in sandboxed scripts, potentially leading to unauthorized access, data breaches, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
While there is no specific known exploit available, the vulnerability can be leveraged by attackers to execute arbitrary code within sandboxed scripts. It is crucial to apply the recommended fix to mitigate the risk.
There have been reports of this vulnerability being actively exploited in the wild. It is essential to promptly update the Jenkins Script Security Plugin to protect your Jenkins installation.
No, upgrading the Jenkins Script Security Plugin to the fixed version is the only known solution to mitigate the risk posed by this vulnerability. It is recommended to apply the fix as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
