Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2019-10417: Jenkins Kubernetes Plugin Allows Attackers to Invoke Arbitrary Methods
CVE-2019-10417 · published 7 years ago
Summary
The Jenkins Kubernetes Plugin has a security flaw that allows attackers to bypass normal protections and execute unauthorized code. This affects users who use the plugin to run Jenkins pipelines on Kubernetes. To stay secure, update the plugin to the latest version or remove it if not needed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | fabric8 | io.fabric8.pipeline:kubernetes-pipeline-steps | <= 1.6 |
| – | jenkins | kubernetes_pipeline |
<= 1.6 cpe:2.3:a:jenkins:kubernetes_pipeline:*:*:*:*:*:jenkins:*:* |
Original advisory text
Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-183Permissive List of Allowed Inputs
CWE-863Incorrect Authorization
Timeline
Published25 Sep 2019
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta