CVE-2026-92125: Jenkins Script Security Plugin RCE Vulnerability

CVE-2026-92125 Overview

CVE-2026-92125 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to reject the @GroovyASTTransformationClass annotation in sandboxed Groovy scripts. Attackers with permission to define and run sandboxed scripts, including Pipelines, can execute an arbitrary Abstract Syntax Tree (AST) transformation at compile time. This bypasses the sandbox protection and executes arbitrary code in the context of the Jenkins controller Java Virtual Machine (JVM). The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can escape the Groovy sandbox and achieve arbitrary code execution on the Jenkins controller, compromising build integrity, credentials, and downstream systems.

Affected Products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Jenkins controllers using sandboxed Groovy Pipelines
Jenkins environments allowing users to define sandboxed scripts

Discovery Timeline

2026-09-16 - CVE-2026-92125 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-3925 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92125

Vulnerability Analysis

The Script Security Plugin implements a sandbox that restricts which Groovy language features and APIs untrusted scripts can invoke at runtime. The sandbox denies dangerous method calls and reflection operations to prevent code execution outside a controlled subset. However, the plugin does not filter the @GroovyASTTransformationClass annotation before compilation. AST transformations execute during compilation, not runtime, so runtime-only sandbox checks never observe the malicious code path.

An attacker with permission to submit a Pipeline or sandboxed Groovy script can attach the annotation to a class or method. The Groovy compiler then loads and invokes the attacker-referenced transformation class inside the Jenkins controller JVM. Because the transformation runs with full JVM privileges, the attacker gains arbitrary code execution on the controller, including access to credentials, build agents, and secrets stored on the controller filesystem.

Root Cause

The root cause is incomplete input validation on Groovy annotations processed prior to sandbox enforcement. The plugin's compilation pipeline treats @GroovyASTTransformationClass as a benign annotation, allowing compile-time code paths to run unrestricted. This is a code injection weakness [CWE-94] where the trust boundary between untrusted script input and privileged compiler behavior is not enforced.

Attack Vector

Exploitation requires network access to Jenkins and low-privilege authenticated access with permission to define or run sandboxed scripts, such as the Overall/Read and Pipeline job configuration rights. No user interaction is required. The attacker crafts a Pipeline or Groovy script containing the @GroovyASTTransformationClass annotation pointing to a class that executes arbitrary Java code. When Jenkins compiles the script, the transformation runs in the controller JVM outside the sandbox. Technical details are documented in the Jenkins Security Advisory SECURITY-3925.

Detection Methods for CVE-2026-92125

Indicators of Compromise

Pipeline definitions or Groovy scripts containing @GroovyASTTransformationClass annotations submitted by non-administrative users
Unexpected class loading events in Jenkins controller logs during script compilation
New or modified files under $JENKINS_HOME created by Groovy compiler threads
Outbound network connections from the Jenkins controller JVM immediately following script compilation

Detection Strategies

Audit stored Pipeline scripts and job configurations for the @GroovyASTTransformationClass and related annotation strings such as @ASTTest or @Grab
Monitor the Jenkins controller process for child process spawns, especially shells or interpreters started from the Java process
Correlate Jenkins job execution events with credential store access to identify anomalous credential reads

Monitoring Recommendations

Enable Jenkins audit logging and forward logs to a centralized SIEM for annotation-pattern searches
Alert on Script Security Plugin exception traces referencing GroovyASTTransformationClass or compiler failures
Track the Script Security Plugin version across the Jenkins fleet and flag hosts running 1415.v9a_f9b_3a_c253d or earlier

How to Mitigate CVE-2026-92125

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to the fixed version published in the Jenkins Security Advisory SECURITY-3925
Restrict Pipeline creation and script approval permissions to trusted administrators only
Rotate credentials stored on affected Jenkins controllers if unauthorized script execution is suspected
Review recent Pipeline and job configuration changes for suspicious annotation usage

Patch Information

Jenkins has published a fixed release of the Script Security Plugin. Administrators should apply the update through the Jenkins Update Center. Refer to the Jenkins Security Advisory SECURITY-3925 for the exact fixed version and upgrade instructions.

Workarounds

Remove the ability for untrusted users to submit sandboxed scripts by restricting Job/Configure and Pipeline permissions
Disable inline Pipeline script definitions and require scripts to be loaded from trusted Source Code Management repositories with mandatory review
Isolate the Jenkins controller network so that a compromised controller cannot reach sensitive internal systems until patching is complete

bash

# Verify installed Script Security Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep script-security

# Restrict script approval to administrators in Jenkins configuration
# Manage Jenkins -> Security -> Authorization -> Matrix-based security
# Deny 'Overall/Administer' equivalent rights to non-admin users