CVE-2019-1003041: Jenkins Pipeline: Groovy

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

Affected products

• Jenkins Pipeline: Groovy: up to and including 2.64
• Red Hat Openshift Container Platform: version 3.11 only

Published 2019-03-28. Last modified 2026-06-17.