Jenkins Pipeline: Groovy Plugin Sandbox Bypass Remote Code Execution (CVE-2019-1003030)
Executive & SecOps Summary
SECOPS ASSESSMENTJenkins Pipeline: Groovy Plugin 2.63 and earlier
Attackers with pipeline script control can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM
Immediately upgrade Jenkins Pipeline: Groovy Plugin to version 2.64 or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade the 'Pipeline: Groovy' plugin to version 2.64 or later via the Jenkins Plugin Manager. Alternatively, use the Jenkins CLI to perform the update and restart the service safely.
# Download the latest CLI tool and execute safe-restart after plugin update
wget http://localhost:8080/jnlpJars/jenkins-cli.jar
java -jar jenkins-cli.jar -s http://localhost:8080/ safe-restart2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict pipeline creation and execution permissions. Revoke 'Job/Configure' and 'Job/Build' permissions from untrusted users and monitor the Script Approval queue.
# Restrict access control in Jenkins global security configuration
# Ensure 'Enable Hudson Status' and anonymous read access are disabled if not required3. Log Audit & IoC Verification Commands
Use the following commands to verify the installed plugin version and inspect Jenkins logs for potential exploitation attempts.
# Check the installed version of the Pipeline: Groovy plugin in the Jenkins home directory
unzip -p /var/jenkins_home/plugins/workflow-cps.jpi META-INF/MANIFEST.MF | grep -E 'Plugin-Version|Long-Name'
# Scan Jenkins logs for sandbox bypass exceptions or suspicious Groovy execution errors
grep -i -E 'org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedSandboxException' /var/log/jenkins/jenkins.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical sandbox bypass vulnerability exists in the Jenkins Pipeline: Groovy Plugin (specifically within CpsGroovyShell.java). The root cause lies in the improper validation of specific Groovy language constructs and AST (Abstract Syntax Tree) transformations during pipeline execution, allowing execution of restricted APIs outside the sandbox environment.
2. Exploitation Mechanics & Attack Scenario
An attacker with permissions to configure or trigger pipelines (e.g., Job/Configure or Job/Build) can craft a malicious Groovy script. By leveraging specific constructor calls or metaprogramming techniques that bypass the sandbox's AST transformer, the script escapes the restricted execution environment and runs arbitrary Java code directly within the Jenkins master JVM process.
3. Infrastructure & Business Impact
With a CVSS score of 9.9 and inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants full control over the Jenkins master node, potentially exposing sensitive credentials, source code repositories, and deployment environments, leading to supply chain compromise.
Official Vendor Advisories & References
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Frequently Asked SecOps Questions (CVE-2019-1003030)
FAQQ1. How critical is CVE-2019-1003030 and is it actively exploited in the wild?
CVE-2019-1003030 is rated CVSS 9.9 (CRITICAL) with a 30-day EPSS exploitation probability of 97.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-1003030?
Primary impacted vendors include jenkins across pipeline-groovy-plugin. Scope summary: Jenkins Pipeline: Groovy Plugin 2.63 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2019-1003030 before patching?
[Mitigation] Immediately upgrade Jenkins Pipeline: Groovy Plugin to version 2.64 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-1003030
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jenkins)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.