Description

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T16:17:30.470Z",
  "pubdate": "2026-09-02T16:17:30.470Z",
  "executiveSummary": "The Jenkins Script Security Plugin, in versions 1412.v7737b_3405f86 and earlier, is susceptible to an information disclosure vulnerability.\nThe vulnerability stems from the improper use of the @DataBoundConstructor annotation on a constructor responsible for loading script approval configurations.\nThis flaw allows an attacker capable of submitting specific forms to unauthorizedly access and read sensitive script approval configurations.\nThe risk implication is significant as script approval settings may contain sensitive information regarding authorized scripts and execution permissions within the Jenkins environment.\nExploitation requires an attacker to have the capability to submit targeted forms to the Jenkins application, potentially allowing them to bypass intended access controls for security configurations.\nThis vulnerability highlights a critical security misconfiguration where internal data structures are improperly exposed through automated data binding mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of the @DataBoundConstructor annotation on a constructor that manages script approval configurations within the Jenkins Script Security Plugin.\nIn Jenkins, the @DataBoundConstructor annotation is used to facilitate the instantiation of objects from form submissions, typically for plugin configuration. By applying this annotation to a constructor that handles sensitive script approval data, the plugin inadvertently exposes the ability to invoke this constructor via external form submissions.\nThe attack flow initiates when an attacker crafts a malicious or specially formed HTTP request that targets the vulnerable endpoint associated with the @DataBoundConstructor. Because the constructor is incorrectly exposed, the Jenkins data binding mechanism processes the request, attempting to initialize the object using the provided parameters.\nDuring this initialization process, the system loads the script approval configuration. Due to the improper scoping and lack of adequate input validation or authorization checks at this specific entry point, the internal configuration state is leaked back to the attacker via the application response.\nThe vulnerable component is the script approval configuration loading logic within the Script Security Plugin. This flaw affects all versions up to and including 1412.v7737b_3405f86.\nExploitation does not necessarily require administrative privileges if the form submission endpoint is accessible to users with lower-level permissions; however, it does necessitate the ability to reach and interact with the vulnerable form submission handling logic.\nThe post-exploitation impact includes the unauthorized disclosure of script approval lists, which may reveal restricted scripts, security tokens, or environment-specific logic that would otherwise be protected. This information can be leveraged by an attacker to facilitate further attacks, such as identifying targets for sandbox escapes, discovering insecure script implementations, or gaining deeper insights into the Jenkins security architecture to prepare for more complex exploitation vectors.\nThe technical failure is effectively an improper authorization check combined with an insecurely exposed internal API endpoint that is intended for internal configuration management but is reachable through standard user-facing form submission pathways."
}