CVE-2026-92123 Overview
CVE-2026-92123 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to intercept operations performed on a null receiver, including method calls, property accesses, attribute accesses, and array accesses. Attackers with permission to define and run sandboxed scripts, including Pipelines, can leverage this gap to escape the sandbox. Successful exploitation results in arbitrary code execution in the context of the Jenkins controller Java Virtual Machine (JVM). The weakness is tracked under [CWE-693] Protection Mechanism Failure.
Critical Impact
Authenticated attackers can bypass the Groovy sandbox and execute arbitrary code on the Jenkins controller, exposing build secrets, credentials, and connected infrastructure.
Affected Products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
- Jenkins Pipeline jobs relying on sandboxed Groovy execution
- Jenkins controllers running affected plugin versions
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-92123 published to NVD
- 2026-09-16 - Jenkins Security Advisory SECURITY-3931 released
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92123
Vulnerability Analysis
The Jenkins Script Security Plugin provides the sandbox that constrains what Groovy scripts and Pipeline definitions can do on the Jenkins controller. The sandbox intercepts method invocations, property lookups, and field accesses to enforce an allowlist of safe operations. This vulnerability arises because the sandbox does not intercept operations performed against a null receiver. Attackers can craft expressions that invoke methods, access properties, or read array elements on a null reference and evade the security checks. Once the sandbox is bypassed, script execution proceeds with the full privileges of the Jenkins controller JVM. That level of access exposes credentials, build artifacts, source repositories, and any system reachable from the controller.
Root Cause
The root cause is an incomplete protection mechanism [CWE-693] in the sandbox interception logic. Operation dispatch on null receivers is not routed through the security manager, leaving a class of Groovy expressions unchecked. The plugin treats these operations as safe by omission rather than by explicit validation.
Attack Vector
Exploitation requires an authenticated Jenkins user with permission to define and run sandboxed scripts, such as Overall/Read combined with Job/Configure on Pipeline jobs. The attacker submits a Pipeline or script that triggers an intercepted operation against a null reference, breaks out of the sandbox, and executes arbitrary Java or Groovy code on the controller. See the Jenkins Security Advisory SECURITY-3931 for advisory-level technical details.
// No verified public exploit code is available.
// Refer to the Jenkins Security Advisory SECURITY-3931 for advisory details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-92123
Indicators of Compromise
- Unexpected child processes spawned by the Jenkins controller JVM, particularly shells, curl, wget, or scripting interpreters.
- New or modified Pipeline scripts and job configurations submitted by low-privilege users prior to unusual controller activity.
- Outbound network connections from the Jenkins controller to previously unseen hosts.
- Access to credential stores, secrets/ directory, or SSH keys on the controller filesystem outside of normal build workflows.
Detection Strategies
- Review Jenkins audit logs for script approval requests, Pipeline changes, and script console usage by non-administrative accounts.
- Correlate build execution telemetry with process and file activity on the controller host to identify sandbox escape behavior.
- Alert on Groovy scripts referencing operations on null values combined with reflective calls or class loading.
Monitoring Recommendations
- Enable and centralize Jenkins system, audit, and job logs into your SIEM or data lake for retention and search.
- Monitor the Jenkins controller host with an endpoint agent that captures process lineage, file access, and network egress.
- Track plugin inventory and version drift across all Jenkins controllers to identify unpatched instances quickly.
How to Mitigate CVE-2026-92123
Immediate Actions Required
- Upgrade the Jenkins Script Security Plugin to the fixed release identified in Jenkins Security Advisory SECURITY-3931.
- Audit users who hold Job/Configure, Job/Build, or script-related permissions and remove access that is not required.
- Review recent Pipeline changes and script approvals for suspicious modifications submitted before the patch was applied.
- Rotate credentials, tokens, and SSH keys stored on any Jenkins controller that ran the vulnerable plugin version.
Patch Information
Jenkins has released a fixed version of the Script Security Plugin addressing the missing sandbox interception on null receivers. Administrators should install the patched version through the Jenkins Update Center. Consult Jenkins Security Advisory SECURITY-3931 for the exact fixed version and upgrade guidance.
Workarounds
- Restrict the ability to define or run sandboxed scripts to trusted administrators until the patch is deployed.
- Disable or block Pipeline job creation and modification for untrusted users through role-based access control.
- Isolate the Jenkins controller from sensitive networks and credentials while remediation is in progress.
# Example: list installed plugin version to confirm exposure
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep script-security
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
