CVE-2026-92122: Jenkins Script Security Plugin RCE Vulnerability

CVE-2026-92122 Overview

CVE-2026-92122 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to check methods invoked through proxies created when a sandboxed script coerces a value to an interface. When the underlying value inherits a method with the same name as an interface method, the sandbox does not intercept the call. Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection and execute arbitrary code in the context of the Jenkins controller Java Virtual Machine (JVM).

Critical Impact
Authenticated users who can submit sandboxed Groovy scripts or Pipelines can achieve arbitrary code execution on the Jenkins controller, compromising build integrity, credentials, and connected infrastructure.

Affected Products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Jenkins Pipelines relying on the Script Security sandbox
Jenkins controllers that permit users to define sandboxed Groovy scripts

Discovery Timeline

2026-09-16 - Jenkins publishes security advisory SECURITY-3929
2026-09-16 - CVE-2026-92122 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92122

Vulnerability Analysis

The Jenkins Script Security Plugin implements a Groovy sandbox that intercepts method calls to prevent sandboxed scripts from invoking dangerous APIs. When a sandboxed script coerces a value to an interface, the plugin creates a proxy that is expected to route interface method invocations through the sandbox's method-call checks.

The defect is a protection mechanism failure [CWE-693]. When the coerced value already inherits a method whose name matches an interface method, the proxy dispatches the call to the inherited implementation without validating it against the sandbox allowlist. This shortcut skips the checkedCall logic that normally rejects disallowed methods.

Because the bypass runs inside the Jenkins controller JVM, arbitrary code executes with the privileges of the Jenkins process, exposing build secrets, credentials, agents, and administrative APIs.

Root Cause

The root cause is inconsistent enforcement of method-call interception on interface-coerced proxies. The plugin resolves method dispatch by name resolution against the inherited class hierarchy rather than treating every invocation through the proxy as a sandbox-checked call.

Attack Vector

An authenticated attacker with the Overall/Read and job-level permissions required to submit a Pipeline or sandboxed script crafts a Groovy script that defines a class inheriting a method whose name matches an interface method. The script coerces an instance to that interface using Groovy's as operator and invokes the method through the proxy. The invocation dispatches to the inherited implementation without sandbox validation, yielding arbitrary Java execution inside the controller JVM. See the Jenkins Security Advisory 2026-09-16 for the vendor description.

Detection Methods for CVE-2026-92122

Indicators of Compromise

Unexpected child processes spawned by the Jenkins controller JVM, such as shells, curl, or wget
Pipeline or script console jobs that invoke Groovy as coercions to interfaces followed by method calls
Outbound network connections from the Jenkins controller to unfamiliar hosts during build execution
New or modified credentials, API tokens, or SSH keys within the Jenkins configuration

Detection Strategies

Audit Jenkins job configurations and Pipeline definitions for Groovy scripts that use as interface coercion combined with same-named inherited methods
Correlate RejectedAccessException gaps with successful sandboxed method calls in Jenkins system logs
Monitor Script Security Plugin version across controllers to identify unpatched instances

Monitoring Recommendations

Enable process and command-line telemetry on the Jenkins controller host and alert on non-build child processes
Ingest Jenkins audit and system logs into a centralized analytics platform for anomaly review
Track additions to the sandbox approval list and review any manually approved signatures

How to Mitigate CVE-2026-92122

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to the fixed release identified in the Jenkins Security Advisory 2026-09-16
Restrict the Job/Configure and Pipeline creation permissions to trusted users until patching is complete
Rotate credentials, API tokens, and SSH keys stored in Jenkins if unpatched controllers were exposed to untrusted users

Patch Information

Jenkins addressed CVE-2026-92122 in the Script Security Plugin update referenced in advisory SECURITY-3929, published 2026-09-16. Administrators should apply the update through the Jenkins Plugin Manager and restart the controller. Confirm the installed version is later than 1415.v9a_f9b_3a_c253d.

Workarounds

Disable script execution for untrusted users by removing job configuration and Pipeline creation permissions
Require Pipeline scripts to be loaded from trusted Source Control Management (SCM) repositories using the Trusted library configuration
Enforce mandatory review of pending script approvals and reject entries that use interface coercion patterns

bash

# Verify installed Script Security Plugin version
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="script-security") | {version, enabled}'