CVE Intelligence
Analysis AI-assisted

CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Enabling Code Execution

CVE-2019-1003029 is a sandbox bypass in the Jenkins Script Security Plugin 1.53 and earlier that lets users with Overall/Read permission run arbitrary code on the Jenkins master JVM. NVD rates it critical with a CVSS 3.1 base score of 9.9, and CISA lists it in the Known Exploited Vulnerabilities catalog. The record names no fixed version, so administrators should follow the Jenkins advisory and update the plugin.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2019-1003029 affects the Jenkins Script Security Plugin, version 1.53 and earlier. The record describes a sandbox bypass that lets a user with Overall/Read permission execute arbitrary code on the Jenkins master JVM. The Jenkins advisory cited in the record is Jenkins security advisory 2019-03-06.

Impact

  • The record describes code execution on the Jenkins master JVM.
  • The required privilege is Overall/Read, a low-privilege authenticated role, which matches the PR:L component of the CVSS vector.
  • NVD lists a CVSS 3.1 base score of 9.9 (critical) with high confidentiality, integrity and availability impact. NVD also lists a CVSS 2.0 score of 6.5.

Affected products and versions

  • Jenkins Script Security Plugin 1.53 and earlier, as listed in the record.
  • Red Hat OpenShift Container Platform 3.11 appears in the record's affected list, but the record does not explain how it is affected. See Red Hat advisory RHSA-2019:0739.
  • The record contains no fixed version.

Exploitation status

  • CISA lists this CVE in the Known Exploited Vulnerabilities catalog, with a date added of 2022-04-25 and a due date of 2022-05-16. Ransomware use is recorded as unknown. See the CISA KEV catalog.
  • The SSVC exploitation value in the record is active, and automatable is recorded as no.
  • The record gives an EPSS probability of 0.7444 with a percentile of 0.99487.

Remediation and mitigation

  • Identify Script Security Plugin installations at version 1.53 or earlier, including those on Jenkins master controllers.
  • Apply updates according to vendor instructions, as the KEV required action states. Use the Jenkins advisory to identify the fixed release, since the record does not name it.
  • Limit Overall/Read and other low-privilege access to Jenkins to trusted users.
  • Review whether untrusted users have had access to controllers running this plugin.

Detection guidance

  • Inventory plugin versions across all Jenkins controllers and check them against the affected range.
  • Review Jenkins audit and build logs for unexpected script execution or unusual activity by low-privilege accounts.
  • Where telemetry allows, monitor the master JVM for unexpected child processes or outbound connections.

Limitations of the available information

  • The record does not name the fixed Script Security Plugin version.
  • The CWE field is null in the record.
  • The record does not describe the bypass mechanism beyond the listed source files.
  • The record does not explain the impact on Red Hat OpenShift Container Platform 3.11.
  • The record does not confirm public exploit availability.

Frequently asked questions

Which Jenkins Script Security Plugin versions are affected by CVE-2019-1003029?

The record lists Jenkins Script Security Plugin version 1.53 and earlier as affected. Check your installed plugin version against the Jenkins advisory.

Is CVE-2019-1003029 known to be exploited?

Yes. The record shows the CVE is listed in the CISA Known Exploited Vulnerabilities catalog, added on 2022-04-25 with a due date of 2022-05-16.

Does the record give a fixed version?

No. The record does not name a fixed version, so use the Jenkins advisory and vendor instructions to identify the release that resolves the issue.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.