CVE-2026-84659

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1412.v7737b 3405f86

Description An issue exists where a permission check is not enforced in the method controlling the "Force the use of the sandbox globally in the system" setting. This allows attackers to disable the global sandbox requirement through Stapler data binding, a mechanism that maps URL patterns to Java objects and their properties.

Recommendations Update Jenkins Script Security Plugin to a version later than 1412.v7737b 3405f86.