CVE-2026-92126 Overview
CVE-2026-92126 affects the Jenkins Script Security Plugin, versions 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to reject Groovy @Builder annotations whose builderStrategy member references an arbitrary class. Attackers with permission to define and run sandboxed scripts, including Jenkins Pipelines, can execute code outside the sandbox. Successful exploitation requires a suitable class to be present on the classpath of the component evaluating the script. This condition is common in Jenkins controller environments where numerous plugins contribute classes. The issue is documented in the Jenkins Security Advisory 2026-09-16 under identifier SECURITY-3925.
Critical Impact
Authenticated users with script definition rights can escape the Groovy sandbox and execute arbitrary code in the context of the Jenkins controller.
Affected Products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
- Jenkins Pipelines and other components that evaluate sandboxed Groovy scripts
- Jenkins controllers with plugins contributing exploitable classes to the classpath
Discovery Timeline
- 2026-09-16 - Jenkins publishes Security Advisory SECURITY-3925
- 2026-09-16 - CVE-2026-92126 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92126
Vulnerability Analysis
The Script Security Plugin enforces a sandbox that restricts which classes and methods sandboxed Groovy scripts can invoke. The @Builder annotation from Groovy's transformation library accepts a builderStrategy member that points to a builder class. In vulnerable versions, the sandbox does not validate or restrict the class named by builderStrategy. As a result, the annotation processor instantiates and invokes methods on the referenced class during compilation or evaluation. Because this happens through the annotation transformation pipeline, the resulting code executes outside the sandbox boundary. Any class reachable on the evaluator's classpath becomes a candidate gadget for sandbox escape. This is classified as a sandbox bypass leading to Remote Code Execution (RCE) on the Jenkins controller.
Root Cause
The root cause is missing input validation on annotation members processed by the sandbox transformer. The plugin allows @Builder(builderStrategy = SomeClass) without ensuring SomeClass belongs to the sandbox allowlist. Groovy's AST transformation invokes the strategy class outside sandbox interception, bypassing script security controls.
Attack Vector
An attacker requires Jenkins permissions to define or run sandboxed scripts, such as Job/Configure or Pipeline authoring rights. The attacker submits a Groovy script that declares a class annotated with @Builder and sets builderStrategy to a class present on the controller classpath. When Jenkins evaluates the script, the annotation transformation triggers execution of methods on that class outside sandbox restrictions. This yields arbitrary code execution with the privileges of the Jenkins controller process. Refer to the Jenkins Security Advisory 2026-09-16 for the full technical description.
Detection Methods for CVE-2026-92126
Indicators of Compromise
- Pipeline or script definitions containing @Builder annotations with a non-default builderStrategy argument.
- Unexpected child processes spawned by the Jenkins controller Java Virtual Machine (JVM) following script execution.
- Audit log entries showing script approvals or Pipeline runs by users who do not typically author build logic.
Detection Strategies
- Scan Jenkinsfiles, job configurations, and shared libraries for the literal pattern builderStrategy combined with @Builder.
- Monitor the Jenkins audit trail for sandbox-related errors, security exceptions, and script approval requests.
- Correlate controller process telemetry with Pipeline execution events to identify unexpected command invocations.
Monitoring Recommendations
- Enable and centralize Jenkins system and audit logs, then forward them to a Security Information and Event Management (SIEM) platform.
- Alert on new Pipeline job creations or script edits by non-administrator accounts.
- Track outbound network connections and process creation events from the Jenkins controller host.
How to Mitigate CVE-2026-92126
Immediate Actions Required
- Upgrade the Script Security Plugin to a version later than 1415.v9a_f9b_3a_c253d as published in the Jenkins advisory.
- Restrict Overall/Administer, Job/Configure, and Pipeline authoring permissions to trusted users only.
- Audit existing Jenkinsfiles and shared libraries for @Builder usage referencing arbitrary builderStrategy classes.
Patch Information
Jenkins released a fixed Script Security Plugin version alongside the Jenkins Security Advisory 2026-09-16. The patched plugin rejects @Builder annotations whose builderStrategy member names classes outside the sandbox allowlist. Administrators should apply the update through the Jenkins Plugin Manager and restart the controller.
Workarounds
- If patching is delayed, revoke script definition and Pipeline configuration permissions from non-administrative users.
- Require manual script approval for all sandboxed scripts and reject any script that uses @Builder with builderStrategy.
- Isolate the Jenkins controller on a segmented network and limit the classes available on its classpath by removing unused plugins.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.