CVE-2026-92129: 
Jenkins vulnerability analysis and mitigation

CVE-2026-92129 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin (tracked as SECURITY-3977) that allows authenticated attackers to execute code outside the Groovy sandbox. The flaw affects Script Security Plugin versions up to and including 1415.v9a_f9b_3a_c253d and was disclosed on September 16, 2026, via the Jenkins Security Advisory. It carries a CVSS v3.1 base score of 7.5 (High) (Jenkins Advisory, GitHub Advisory).

The root cause is classified as CWE-693 (Protection Mechanism Failure). Groovy supports extending existing classes at runtime with additional methods (via Groovy's metaprogramming/metaclass system), and Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier fails to intercept or validate calls to these dynamically added methods when invoked from within a sandboxed script. Critically, exploitation requires that the target dynamically added methods were already defined by code running outside the sandbox — such as a Jenkins plugin — since sandboxed scripts cannot extend classes themselves. The attack vector is network-based, requires low privileges (script execution permission), and has high attack complexity (Jenkins Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker with permission to define and run sandboxed scripts (including Jenkins Pipelines) to execute arbitrary code in the context of the Jenkins controller JVM, fully escaping sandbox restrictions. This results in high confidentiality, integrity, and availability impact — an attacker could read sensitive credentials and secrets stored in Jenkins, modify build configurations or artifacts, disrupt CI/CD operations, and potentially pivot to other systems accessible from the Jenkins controller (Jenkins Advisory, GitHub Advisory).

No public proof-of-concept exploit has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.45–0.48%, placing it in the 39th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that a suitable dynamically added method must already exist on the classpath, introduced by a plugin running outside the sandbox, which raises the practical attack complexity (GitHub Advisory).

1. Identify a target: Locate a Jenkins instance running Script Security Plugin version 1415.v9a_f9b_3a_c253d or earlier with an installed plugin that dynamically adds methods to existing Groovy/Java classes at runtime via Groovy's metaclass system.
2. Obtain script execution permission: Authenticate to Jenkins with an account that has permission to define and run sandboxed scripts (e.g., Pipeline job creation or Groovy script console access within a sandboxed context).
3. Identify dynamically added methods: Enumerate installed plugins to find one that registers methods on existing classes at runtime (outside the sandbox), making those methods callable via Groovy's metaclass.
4. Craft a malicious sandboxed script: Write a Groovy Pipeline or sandboxed script that calls the dynamically added method on the target class. Because the Script Security Plugin does not check these calls, the invocation bypasses sandbox interception.
5. Execute code outside the sandbox: The dynamically added method executes in the Jenkins controller JVM context without sandbox restrictions, enabling arbitrary code execution — such as reading credentials, spawning processes, or exfiltrating data. (Jenkins Advisory)

Update the Jenkins Script Security Plugin to version 1422.v06869826dd9b_ or later, which rejects calls from sandboxed scripts to methods added dynamically to classes at runtime. As an interim measure, restrict permissions to define and run sandboxed scripts (including Pipelines) to trusted users only. Additionally, audit installed plugins for any that dynamically extend classes at runtime and assess their trustworthiness, as such plugins are a prerequisite for exploitation (Jenkins Advisory).

The Jenkins project disclosed this vulnerability as part of a broader September 16, 2026 security advisory covering 20 plugin vulnerabilities, several of which were sandbox bypass issues in the Script Security Plugin. Security news outlets including GBHackers and UnderCode News covered the advisory, highlighting the sandbox escape and credential theft risks to CI/CD controllers. The advisory noted that multiple vulnerabilities were reported through the Jenkins Bug Bounty Program sponsored by the European Commission, reflecting ongoing investment in Jenkins security research (GBHackers, UnderCode News, Jenkins Advisory).