CVE-2026-92131: Jenkins Pipeline Groovy Path Traversal

CVE-2026-92131 Overview

CVE-2026-92131 is a path traversal vulnerability [CWE-22] in the Jenkins Pipeline: Groovy Libraries Plugin. Versions 805.va_fc79344957d and earlier fail to restrict the library path supplied to the library Pipeline step to a relative path inside the Source Code Management (SCM) checkout. The plugin also follows symbolic links pointing outside the checkout directory when retrieving libraries. Attackers with permission to configure Pipelines can read files from a resources directory and delete files from a test directory on the Jenkins controller file system.

Critical Impact
Authenticated users with Pipeline configuration rights can read and delete arbitrary files on the Jenkins controller, exposing secrets and disrupting build integrity.

Affected Products

Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d
All prior versions of the Jenkins Pipeline: Groovy Libraries Plugin
Jenkins controllers running the affected plugin versions

Discovery Timeline

2026-09-16 - CVE-2026-92131 published to the National Vulnerability Database (NVD)
2026-09-16 - Jenkins Security Advisory SECURITY-3796 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92131

Vulnerability Analysis

The Pipeline: Groovy Libraries Plugin loads shared libraries referenced in Jenkins Pipeline definitions through the library step. The plugin is expected to constrain library retrieval to files within the SCM checkout directory. It does not enforce this constraint. Additionally, the plugin follows symbolic links during retrieval, allowing traversal to arbitrary filesystem locations on the Jenkins controller.

An attacker with Item/Configure permission can craft a Pipeline referencing a library path that escapes the checkout root. The retrieval logic reads files from the resources directory and deletes files in the test directory using paths that leave the intended sandbox. This exposes credentials, configuration files, and other sensitive artifacts stored on the controller.

Root Cause

The root cause is insufficient input validation on library paths supplied to the library Pipeline step. The plugin does not canonicalize paths or reject values that resolve outside the SCM checkout. It also lacks symbolic link resolution checks, treating linked targets as trusted locations. This combination enables classic directory traversal outside the intended sandbox.

Attack Vector

Exploitation requires network access to the Jenkins controller and authenticated access with permission to configure Pipeline jobs. High attack complexity reflects the need to know target file paths on the controller and to craft SCM contents containing symbolic links or traversal sequences. The attacker configures a Pipeline that invokes the library step with a manipulated path or points to an SCM repository containing symlinks that resolve to controller filesystem locations. See the Jenkins Security Advisory SECURITY-3796 for technical details.

Detection Methods for CVE-2026-92131

Indicators of Compromise

Unexpected library step invocations in Pipeline job configurations referencing non-standard paths or path traversal sequences such as ../
SCM checkouts containing symbolic links whose targets resolve outside the workspace directory
Missing or unexpectedly deleted files within Pipeline test directories on the Jenkins controller
Access to sensitive files such as secrets/, credentials.xml, or config.xml correlated with Pipeline execution

Detection Strategies

Audit Jenkins Pipeline definitions for library step calls containing suspicious relative paths or references to shared libraries not registered globally
Enable Jenkins audit logging to track Pipeline configuration changes and Item/Configure permission usage
Monitor filesystem access on the Jenkins controller for reads and deletes originating from the Jenkins process outside expected workspace paths

Monitoring Recommendations

Alert on file deletions inside $JENKINS_HOME subdirectories triggered by Pipeline runs
Track plugin version inventory across Jenkins controllers and flag hosts running Pipeline: Groovy Libraries Plugin at or below 805.va_fc79344957d
Review users with Job/Configure or Item/Configure permissions and validate that the principle of least privilege applies

How to Mitigate CVE-2026-92131

Immediate Actions Required

Upgrade the Jenkins Pipeline: Groovy Libraries Plugin to the fixed release identified in Jenkins Security Advisory SECURITY-3796
Restrict Item/Configure and Job/Configure permissions to trusted users only
Review Pipeline job definitions across the Jenkins instance for suspicious library step usage
Rotate any credentials or secrets that may have resided in accessible controller directories

Patch Information

The Jenkins project has published a fixed version of the Pipeline: Groovy Libraries Plugin as part of the September 16, 2026 security advisory cycle. Administrators should apply the update through the Jenkins Update Center. Consult the Jenkins Security Advisory SECURITY-3796 for the exact fixed version and release notes.

Workarounds

Limit Pipeline configuration permissions to a small set of trusted administrators until the patch is applied
Disable or remove the Pipeline: Groovy Libraries Plugin if shared library functionality is not required
Store Pipeline SCM sources in trusted repositories and reject pull requests that introduce symbolic links inside library resource paths

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep pipeline-groovy-lib

# Upgrade the plugin to the fixed release
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin pipeline-groovy-lib -deploy