CVE-2026-92127: Jenkins Script Security Plugin RCE Vulnerability

CVE-2026-92127 Overview

CVE-2026-92127 affects the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin automatically approves classpath entries in item configurations when a user with Overall/Administer permission copies an item or updates its configuration through the REST API or CLI. Attackers able to define classpath entries can exploit this behavior to execute arbitrary code in the context of the Jenkins controller JVM. The flaw maps to [CWE-94] Improper Control of Generation of Code and enables code injection against a core continuous integration component.

Critical Impact
Arbitrary code execution in the Jenkins controller JVM, giving attackers control over build pipelines, credentials, and downstream infrastructure.

Affected Products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Jenkins controllers loading the affected plugin version
Downstream pipelines and jobs relying on classpath approval enforcement

Discovery Timeline

2026-09-16 - CVE-2026-92127 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-3897 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92127

Vulnerability Analysis

The Script Security Plugin governs which Groovy scripts and classpath entries Jenkins will load. Classpath entries normally require explicit administrator approval before Jenkins loads them into the controller JVM. This approval workflow exists to prevent unreviewed JAR files or class directories from executing on the controller.

In affected versions, the plugin bypasses that approval workflow in three specific paths. When a user with Overall/Administer permission copies an item, updates configuration through the REST API, or updates configuration through the CLI, classpath entries in the resulting configuration are auto-approved. An attacker who can influence classpath entries and trigger one of these paths achieves code execution inside the Jenkins controller JVM.

Root Cause

The root cause is an implicit trust decision in the plugin's configuration handlers. The code assumes any classpath entries present during copy or API/CLI-driven configuration updates were previously vetted. The plugin marks them as approved without re-validating them through the standard approval queue, violating the security boundary the plugin is designed to enforce [CWE-94].

Attack Vector

Exploitation requires network access to the Jenkins controller and low-privileged authentication combined with user interaction from a privileged account. An attacker seeds classpath entries pointing to attacker-controlled JAR files or class directories, then induces a user with Overall/Administer permission to copy the item or trigger a REST/CLI configuration update. Once the entries are auto-approved, the malicious classes execute in the controller JVM. The referenced code runs with the privileges of the Jenkins controller process, exposing stored credentials, SCM tokens, and connected build agents.

// No verified proof-of-concept code is published for CVE-2026-92127.
// Refer to the Jenkins Security Advisory 2026-09-16 (SECURITY-3897) for technical details.

Detection Methods for CVE-2026-92127

Indicators of Compromise

Unexpected entries in the Script Security approved classpath list that were not manually approved by an administrator.
New or modified JAR files in Jenkins job workspaces or on paths referenced by pipeline classpath directives.
Outbound network connections from the Jenkins controller JVM to previously unseen hosts.
Audit log entries showing item copy or REST/CLI config.xml updates by Overall/Administer accounts followed by pipeline builds using new classpath entries.

Detection Strategies

Compare the current approved classpath list against a known-good baseline and alert on unreviewed additions.
Monitor Jenkins REST API and CLI endpoints for config.xml updates that include <classpath> elements.
Correlate item-copy actions with subsequent pipeline executions that reference newly added classpath resources.

Monitoring Recommendations

Forward Jenkins controller audit logs and plugin approval events to a central logging platform for review.
Track process execution and file writes originating from the Jenkins controller JVM to identify post-exploitation activity.
Alert on Jenkins controllers spawning unexpected child processes such as shells, curl, or compilers outside normal build behavior.

How to Mitigate CVE-2026-92127

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to a version later than 1415.v9a_f9b_3a_c253d as published in the Jenkins Security Advisory 2026-09-16.
Audit the current approved classpath list and revoke any entries that cannot be attributed to a deliberate administrator approval.
Rotate credentials, SCM tokens, and API keys stored on the Jenkins controller if exploitation is suspected.
Review recent item copies and REST/CLI configuration updates performed by Overall/Administer accounts.

Patch Information

Jenkins addressed the issue in the Script Security Plugin release referenced by the Jenkins Security Advisory 2026-09-16 (SECURITY-3897). Administrators should apply the fixed plugin version through the Jenkins Update Center and restart the controller to complete the upgrade.

Workarounds

Restrict Overall/Administer permission to a minimal set of trusted accounts until the patch is applied.
Disable or restrict Jenkins REST API and CLI endpoints that permit configuration updates from non-UI clients.
Block item copy operations for jobs containing user-supplied classpath entries.
Require code review of config.xml changes before applying them to production controllers.

bash

# Verify installed Script Security Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep script-security