CVE-2022-43402

CRITICAL

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with ...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS1.3%
Percentile69th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in the Jenkins Pipeline: Groovy Plugin allows attackers to bypass the sandbox protection and execute arbitrary code on the Jenkins controller JVM.

BSID: BS-2022-GLOBAL-334777-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-43402?
A critical vulnerability in the Jenkins Pipeline: Groovy Plugin allows attackers to bypass the sandbox protection and execute arbitrary code on the Jenkins controller JVM.
What is the CVSS score for CVE-2022-43402?
CVE-2022-43402 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2022-43402 actively exploited?
No confirmed active exploitation of CVE-2022-43402 as of 2026-09-25.
How do I remediate CVE-2022-43402?
Priority: IMMEDIATE. Advisory: https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 PSIRT: [email protected]
What systems are affected by CVE-2022-43402?
CVE-2022-43402 affects Jenkins Pipeline\.
Vulnerability Details
CVE IDCVE-2022-43402
BSIDBS-2022-GLOBAL-334777-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2022-10-19
Last Modified2026-06-17
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability involves implicit casts performed by the Groovy language runtime, enabling attackers with permission to define and run sandboxed scripts to execute arbitrary code.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Jenkins Pipeline\ ≤ 2802.v5ea_628154b_c2
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1457 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash6689bb3c6e619b42fcc1a621681209eda7740dca77fb987e13a01f851077ed313365b547437a02c87fae5d41427c4cbb7b141393a46b3d6f705383755d9eefa2
Related CVEs affecting Jenkins
CVE-2019-10431 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and ear... CVE-2019-10418 9.9 Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom w... CVE-2022-43403 9.9 A sandbox bypass vulnerability involving casting an array-like value to an ar... CVE-2019-1003031 9.9 A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 a... CVE-2020-2279 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and ear...
View all Jenkins CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →