CVE-2019-1003030

Jenkins Pipeline Groovy is used to automate builds and deployments with scripts. This bug lets a malicious script escape the “sandbox” that’s supposed to limit what the script can do, so the attacker can run commands on the main Jenkins server. In practice, that can turn CI/CD automation into a control panel for attackers.

This matters if you use Jenkins Pipeline: Groovy Plugin (workflow-cps) in a Jenkins setup (including Jenkins Pipeline Groovy in Red Hat OpenShift environments that include it). It’s a network-reachable issue in normal setups, but it only becomes a real risk when an attacker can influence Pipeline scripts (for example, by getting access to add/modify pipeline definitions). If an attacker cannot control pipeline scripts, impact is much less direct.

This should be treated as urgent because it is listed in the CISA Known Exploited Vulnerabilities (KEV), meaning it has been exploited in the real world. Attackers can bypass the Groovy sandbox when they can control pipeline scripts, which can lead to direct command execution on your Jenkins server—so you should prioritize patching now.