CVE-2026-42519

MEDIUM

Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2026-42519 has a selected CVSS score of 4.3 (medium).

Description

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 29, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Jenkins Script Security Plugin

Browse Jenkins Project / Jenkins Script Security Plugin

Default status: unaffected

CVE ListThrough 1399.ve6a_66547f6e1affected

org.jenkins-ci.plugins:script-security

Browse Maven / org.jenkins-ci.plugins:script-security
GitHub AdvisoryBefore 1402.v94c9ce464861 · Fixed in 1402.v94c9ce464861affected

References

3