CVE-2026-92124: Jenkins Script Security Plugin RCE Vulnerability

CVE-2026-92124 Overview

CVE-2026-92124 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin, versions 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to properly check Groovy operations when a sandboxed script casts a collection to another type. Groovy performs the cast on the collection itself rather than on the elements read from it, breaking the sandbox's protection model [CWE-693]. Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass the sandbox and execute arbitrary code inside the Jenkins controller Java Virtual Machine (JVM).

Critical Impact
Authenticated users with script-authoring permissions can escape the Groovy sandbox and gain code execution as the Jenkins controller process, exposing credentials, build artifacts, and downstream infrastructure.

Affected Products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d
Jenkins Script Security Plugin versions prior to 1415.v9a_f9b_3a_c253d
Jenkins Pipeline jobs and other integrations that rely on the plugin's sandbox

Discovery Timeline

2026-09-16 - CVE-2026-92124 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-3923 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92124

Vulnerability Analysis

The Jenkins Script Security Plugin enforces a Groovy sandbox that inspects operations performed on objects reachable from user scripts. The plugin's cast handling is scoped incorrectly. When a sandboxed script casts a collection to another type, the plugin evaluates the operations Groovy would perform against the elements of the collection rather than the cast operation applied to the collection object itself.

This mismatch means the actual runtime cast on the collection escapes the interception path. An attacker can craft a cast target whose coercion logic executes attacker-controlled code during type conversion. The Groovy runtime honors the cast, invokes the underlying conversion methods, and runs code that the sandbox never approved.

Successful exploitation grants arbitrary code execution in the Jenkins controller JVM. From this position, an attacker can read Jenkins credentials, decrypt stored secrets, alter build configurations, and pivot to connected agents or source control systems. The classification as an Improper Protection Mechanism [CWE-693] reflects the sandbox itself failing to cover a Groovy language feature it was designed to mediate.

Root Cause

The root cause is a scoping error in how the Script Security Plugin validates Groovy cast expressions. The plugin checks operations against elements produced by the collection instead of the cast applied to the collection object. Any coercion side effect triggered on the collection reference bypasses sandbox interception.

Attack Vector

Exploitation requires an authenticated user with permission to define and run sandboxed scripts, such as Pipeline authors or users with Job/Configure on script-enabled jobs. The attacker submits a Groovy script or Pipeline definition that casts a collection to a type whose coercion path executes attacker-supplied logic. When Jenkins runs the job, the controller JVM executes the payload outside sandbox constraints. No user interaction beyond triggering the build is required.

No public proof-of-concept exploit code is available at this time. Refer to the Jenkins Security Advisory SECURITY-3923 for authoritative technical details.

Detection Methods for CVE-2026-92124

Indicators of Compromise

Unexpected child processes spawned by the Jenkins controller JVM, such as shells, curl, wget, or scripting interpreters launched outside normal build steps.
Pipeline or Groovy job definitions containing unusual cast expressions applied to collections with attacker-controlled target types.
Access to credentials.xml, secrets/ directory, or $JENKINS_HOME files from Pipeline execution contexts that should not require them.
Outbound network connections from the Jenkins controller to unfamiliar hosts during or immediately after sandboxed script execution.

Detection Strategies

Audit stored Pipeline scripts and Groovy job definitions for cast expressions targeting non-standard classes or dynamic type coercions.
Monitor Jenkins audit logs for script approval requests, sandbox violations, and job configuration changes by non-administrative users.
Correlate Jenkins controller process telemetry with build execution timestamps to identify code execution outside expected step boundaries.

Monitoring Recommendations

Forward Jenkins controller endpoint telemetry, audit logs, and build console output to a centralized SIEM for behavioral correlation.
Alert on new outbound connections, credential file reads, and process launches originating from the Jenkins JVM.
Track version inventory of the Script Security Plugin across all Jenkins controllers to confirm patched state.

How to Mitigate CVE-2026-92124

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to the fixed release listed in Jenkins Security Advisory SECURITY-3923.
Restrict Overall/Administer, Job/Configure, and Pipeline authoring permissions to trusted users pending patch deployment.
Rotate Jenkins-managed credentials, API tokens, and SSH keys if unauthorized script execution is suspected.
Review recent Pipeline and Groovy script submissions for suspicious cast expressions or unusual class references.

Patch Information

Jenkins released a fixed version of the Script Security Plugin on 2026-09-16 alongside advisory SECURITY-3923. Administrators should update through the Jenkins Update Center or by deploying the patched .hpi artifact. Restart the Jenkins controller after upgrade to ensure the sandbox interceptors reload.

Workarounds

Disable the ability for non-administrators to define sandboxed Groovy scripts and Pipelines until the plugin is patched.
Require administrator approval for all script submissions by enforcing the Script Approval workflow without sandbox opt-in.
Isolate the Jenkins controller on a segmented network with egress filtering to limit blast radius from a successful sandbox escape.

bash

# Configuration example: verify installed Script Security Plugin version
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="script-security") | {shortName, version, enabled}'