CVE-2026-92137: Jenkins Robot Framework Plugin RCE Vulnerability

CVE-2026-92137 Overview

CVE-2026-92137 is a path traversal vulnerability [CWE-22] affecting the Jenkins Robot Framework Plugin version 6.2.2 and earlier. The plugin fails to validate that the configured archive directory for Robot Framework report files resides within the build directory on the Jenkins controller. Attackers holding Item/Configure permission can create or overwrite arbitrary files on the Jenkins controller file system with attacker-controlled content. This write primitive can be escalated to remote code execution on the Jenkins controller.

Critical Impact
Authenticated attackers with Item/Configure permission can write arbitrary files to the Jenkins controller, leading to remote code execution and full compromise of the CI/CD environment.

Affected Products

Jenkins Robot Framework Plugin 6.2.2
Jenkins Robot Framework Plugin versions prior to 6.2.2
Jenkins controllers running any vulnerable plugin release

Discovery Timeline

2026-09-16 - Jenkins publishes Security Advisory SECURITY-3971
2026-09-16 - CVE-2026-92137 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92137

Vulnerability Analysis

The Jenkins Robot Framework Plugin accepts a user-configured archive directory for storing Robot Framework report files. The plugin does not verify that the supplied path stays within the intended build directory on the Jenkins controller. An attacker who can configure a job can supply a directory string containing traversal sequences such as ../. The plugin then writes report files to the attacker-selected location using the Jenkins controller's process privileges.

Because report content is derived from build artifacts, attackers can control both the destination path and the file content. Overwriting files consumed by the Jenkins controller, such as Groovy init scripts under $JENKINS_HOME/init.groovy.d/, converts the arbitrary file write into remote code execution. The attack executes over the network against the Jenkins web interface and requires only low-privileged authenticated access.

Root Cause

The root cause is missing path canonicalization and containment checks on the archive directory parameter. The plugin trusts the configured path and does not enforce that the resolved absolute path is a descendant of the build directory. This is a classic instance of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires an authenticated Jenkins account with Item/Configure permission on at least one job. The attacker modifies the job's Robot Framework post-build configuration to set an archive directory that escapes the build directory using relative path traversal. When the job runs, the plugin writes report files to the attacker-specified path on the controller. Placing a malicious Groovy script in a controller-side auto-execution directory yields code execution as the Jenkins controller process.

No verified proof-of-concept code is available. See the Jenkins Security Advisory
for authoritative technical details: 
[Jenkins Security Advisory 2026-09-16 - SECURITY-3971](https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3971)

Detection Methods for CVE-2026-92137

Indicators of Compromise

Unexpected files written outside job build directories under $JENKINS_HOME, particularly in init.groovy.d/, plugins/, or users/.
Job configurations (config.xml) containing Robot Framework outputPath or archive directory values with .. sequences or absolute paths.
New or modified Groovy scripts appearing after a job build completes.
Unusual child processes spawned by the Jenkins controller Java process following a Robot Framework build.

Detection Strategies

Audit all Jenkins job configurations for Robot Framework post-build steps and flag archive directory values containing traversal characters or absolute paths.
Monitor file system writes under $JENKINS_HOME originating from the Jenkins controller process outside expected jobs/*/builds/* subtrees.
Correlate job execution events with file creation events in sensitive controller directories using centralized logging.

Monitoring Recommendations

Ingest Jenkins audit logs and file integrity monitoring events into a centralized SIEM or data lake for correlation.
Alert on modifications to init.groovy.d/, secrets/, and plugin JAR files on Jenkins controllers.
Track new job configuration changes made by users with Item/Configure but without Overall/Administer permission.

How to Mitigate CVE-2026-92137

Immediate Actions Required

Upgrade the Jenkins Robot Framework Plugin to a fixed release beyond 6.2.2 as identified in the Jenkins Security Advisory.
Review existing Robot Framework job configurations for suspicious archive directory paths and revert them.
Restrict Item/Configure permission to trusted users until the plugin is patched.

Patch Information

Refer to the Jenkins Security Advisory 2026-09-16 (SECURITY-3971) for the fixed plugin version and upgrade instructions. Apply the update through the Jenkins Plugin Manager and restart the controller.

Workarounds

Remove the Robot Framework Plugin from Jenkins controllers where it is not required.
Enforce least-privilege authorization so that only vetted users hold Item/Configure permission.
Run Jenkins agents and builds under non-privileged accounts and isolate the controller file system from build workloads.

bash

# Audit job configurations for suspicious archive directory values
grep -rE 'outputPath|archiveDirName' $JENKINS_HOME/jobs/*/config.xml \
  | grep -E '\.\./|^/'

# Update the plugin from the Jenkins CLI (replace VERSION with the fixed release)
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin robot-framework:VERSION -restart