CVE-2026-92128 Overview
CVE-2026-92128 affects Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin downloads a JAR file specified by URL twice. It confirms the approval of the first download and then loads classpath entries from the second download. Attackers able to define classpath entries can substitute a different JAR between the two requests. This time-of-check to time-of-use flaw enables arbitrary code execution in the context of the Jenkins controller Java Virtual Machine (JVM). The weakness is classified under [CWE-494: Download of Code Without Integrity Check].
Critical Impact
Attackers with permission to define classpath entries can execute arbitrary code on the Jenkins controller, compromising build integrity and any secrets stored on the controller.
Affected Products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d
- Jenkins Script Security Plugin earlier versions
- Jenkins controllers running the affected plugin
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-92128 published to NVD
- 2026-09-16 - Jenkins Security Advisory SECURITY-3932 released
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92128
Vulnerability Analysis
The Script Security Plugin enforces an approval workflow for classpath entries loaded by Groovy scripts. Administrators approve specific JAR files by URL and hash so trusted code executes on the controller. The plugin validates the first download of the JAR and then issues a second HTTP request to load the classpath entries. Because the second request is independent of the first, the file returned during load time can differ from the file that was approved. An attacker controlling the URL or an intermediary server returns a benign JAR on the first request and a malicious JAR on the second. The malicious classpath entries then execute inside the Jenkins controller JVM with full controller privileges, exposing credentials, build artifacts, and downstream agents.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) flaw combined with missing integrity verification. The plugin approves content fetched at check time but does not verify that the same bytes are loaded at use time. See the Jenkins Security Advisory 2026-09-16 for full technical details.
Attack Vector
Exploitation requires authenticated access with permission to define classpath entries in a sandboxed Groovy script. The attacker hosts a controlled server that returns different JAR content across sequential requests. After administrator approval of the initial fetch, the second fetch loads attacker-controlled classes into the controller JVM.
No verified public exploit code is available. The vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-92128
Indicators of Compromise
- Outbound HTTP or HTTPS requests from Jenkins controllers to unexpected external hosts serving JAR files.
- Multiple sequential downloads of the same JAR URL from the controller with differing response sizes or hashes.
- Newly approved classpath entries in the Script Security Plugin approval store referencing external URLs.
- Unexpected child processes or network connections spawned by the Jenkins controller JVM.
Detection Strategies
- Compare cryptographic hashes of JAR files fetched by the controller against the hashes recorded in the plugin approval store.
- Alert on Groovy script configurations that reference remote classpath URLs rather than locally staged artifacts.
- Review Jenkins audit logs for classpath approval events correlated with new external network destinations.
Monitoring Recommendations
- Monitor Jenkins controller egress traffic and log HTTP responses for JAR content types.
- Track process lineage from the Jenkins controller JVM to detect post-exploitation command execution.
- Forward Jenkins system and audit logs to a centralized SIEM for correlation with network telemetry.
How to Mitigate CVE-2026-92128
Immediate Actions Required
- Upgrade the Script Security Plugin to the version listed in the Jenkins Security Advisory 2026-09-16.
- Revoke and re-review all currently approved classpath entries, particularly those referencing remote URLs.
- Restrict the Overall/Administer and script configuration permissions to trusted users only.
Patch Information
Jenkins published a fixed release of the Script Security Plugin alongside the SECURITY-3932 advisory on 2026-09-16. Administrators should apply the update through the Jenkins Update Center. Refer to the Jenkins Security Advisory 2026-09-16 for exact version numbers and download details.
Workarounds
- Prohibit classpath entries that reference external URLs and require locally staged JAR files under administrator control.
- Place Jenkins controllers behind an egress proxy that restricts outbound traffic to approved artifact repositories only.
- Reduce the population of users with permission to define or approve classpath entries until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
