Exposed CI build servers threaten credentials; Jenkins patches five Script Security sandbox escapes

Build servers such as JetBrains TeamCity and Jenkins hold deployment credentials, registry tokens, signing keys and repository write access, making them high-value targets. Internet scans on 23 October 2026 found 1,890 TeamCity instances on ZoomEye, with 792 served over TLS. On 16 September 2026, Jenkins disclosed five Script Security Plugin vulnerabilities, rated 8.8 or 7.5, that allow sandbox escapes by users permitted to run sandboxed scripts. Because such users can execute code on the controller if a sandbox gap exists, the article argues that limiting who holds pipeline-definition permissions and verifying plugin versions against advisories are key defenses. It also notes that incident reconstruction is hard by default, since build logs and agent output may not capture what the controller executed.