CVE-2026-92129: Jenkins Script Security Plugin RCE Vulnerability

CVE-2026-92129 Overview

CVE-2026-92129 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The plugin fails to check calls from sandboxed scripts to methods added dynamically to a class at runtime. Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection and execute arbitrary code outside the sandbox. The flaw maps to [CWE-693: Protection Mechanism Failure] and affects Jenkins environments that rely on sandboxed Groovy execution for multi-tenant or restricted-user pipeline workflows.

Critical Impact
Authenticated users with script definition privileges can escape the Groovy sandbox and execute code in the Jenkins controller context, compromising build integrity and infrastructure.

Affected Products

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Jenkins Pipeline workflows using sandboxed Groovy scripts
Jenkins controllers hosting the vulnerable plugin

Discovery Timeline

2026-09-16 - CVE-2026-92129 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-3977 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92129

Vulnerability Analysis

The Jenkins Script Security Plugin provides a Groovy sandbox that restricts which methods and classes user-supplied scripts can invoke. The sandbox intercepts method calls and validates each one against an allowlist before execution. CVE-2026-92129 stems from the sandbox omitting validation for methods that are attached to a class dynamically at runtime rather than declared statically.

Groovy supports runtime metaprogramming through mechanisms such as ExpandoMetaClass, category classes, and per-instance metaclass modification. When a script adds a method to an existing class through these facilities, the sandbox does not perform the same call-site check applied to statically declared methods. An attacker can therefore route sensitive operations through a dynamically added method and reach APIs that would otherwise be blocked.

Successful exploitation yields code execution on the Jenkins controller with the privileges of the Jenkins process. This exposes credentials stored in Jenkins, source code, build artifacts, and any downstream systems the controller can reach.

Root Cause

The root cause is an incomplete protection mechanism [CWE-693]. The sandbox's call interception logic enumerates statically resolvable methods but does not consult the runtime metaclass when a script invokes a method added at runtime. This gap allows sandboxed code to reach non-allowlisted behavior through a legitimate Groovy language feature.

Attack Vector

Exploitation requires authenticated access with permission to create or run sandboxed scripts, typically the Overall/Read plus job-level configuration or replay permissions. The attacker submits a Pipeline or script that adds a method to a target class at runtime, then invokes that method to reach APIs outside the sandbox. No user interaction is required, and the attack is delivered over the network to the Jenkins web interface.

Refer to the Jenkins Security Advisory SECURITY-3977 for authoritative technical details. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-92129

Indicators of Compromise

Pipeline or Groovy script executions that invoke metaClass, ExpandoMetaClass, or category (use { ... }) constructs before calling sensitive APIs.
Unexpected process spawns from the Jenkins controller JVM, such as shells, curl, or wget, initiated by build jobs that should be sandboxed.
Outbound network connections from the Jenkins controller to unfamiliar hosts correlated with sandboxed script runs.
Access to credential stores, secrets/ directories, or JENKINS_HOME files from user-defined pipeline contexts.

Detection Strategies

Audit Jenkins build logs and script approval history for scripts that modify metaclasses or add methods to existing classes at runtime.
Enable and review the Jenkins audit trail plugin to correlate script submissions with user identity and job configuration changes.
Apply endpoint behavioral monitoring on Jenkins controller hosts to flag child processes spawned from the Java runtime that deviate from established baselines.

Monitoring Recommendations

Forward Jenkins system logs, job console output, and OS-level process telemetry to a centralized analytics platform for correlation.
Alert on Groovy keywords associated with dynamic method injection appearing in pipeline definitions or replayed builds.
Track authentication events for accounts that hold script execution permissions and review unusual pipeline activity from those users.

How to Mitigate CVE-2026-92129

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to the fixed version published in Jenkins Security Advisory SECURITY-3977.
Inventory all Jenkins controllers and identify instances running Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier.
Review users and API tokens that hold permissions to define or run sandboxed scripts and remove any that are no longer required.
Rotate credentials stored in Jenkins if unauthorized script execution is suspected on the controller.

Patch Information

Jenkins released a fixed version of the Script Security Plugin alongside advisory SECURITY-3977 on 2026-09-16. Administrators should apply the update through the Jenkins Plugin Manager and restart the controller. Confirm the installed plugin version reports higher than 1415.v9a_f9b_3a_c253d after the update.

Workarounds

Restrict the Overall/Administer, job configuration, and replay permissions to trusted operators only until the patch is applied.
Disable in-process script approval and require administrator review of all Pipeline definitions on affected controllers.
Isolate Jenkins controllers from sensitive networks and credential stores using network segmentation and least-privilege service accounts.

bash

# Configuration example: verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins script-security

# Example output line to inspect:
# script-security  Script Security Plugin  <installed-version>