Critical Vulnerability in Jenkins Script Security Plugin Allows Arbitrary Code Execution

Executive Summary

A critical vulnerability, CVE-2026-92124, was discovered in the Jenkins Script Security Plugin. This vulnerability has a CVSS score of 8.8 and allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. The vulnerability affects Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier.

Technical Analysis

The vulnerability is classified as a CWE-693 issue. The Jenkins Script Security Plugin checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself. This flaw allows attackers to bypass the sandbox protection.

How It Gets Exploited

An attacker with permission to define and run sandboxed scripts, including Pipelines, can exploit this vulnerability. The attacker would send a crafted script that performs a cast on a collection, which the plugin incorrectly handles, allowing the execution of arbitrary code in the context of the Jenkins controller JVM. For example, an attacker might send a malicious Groovy script that is designed to exploit this vulnerability, potentially leading to arbitrary code execution.

Impact Assessment

The vulnerability affects Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. Successful exploitation allows an attacker to execute arbitrary code in the context of the Jenkins controller JVM, potentially leading to a complete compromise of the Jenkins environment. The CVSS score of 8.8 indicates a high severity level, with high impacts on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, update the Jenkins Script Security Plugin to a version later than 1415.v9a_f9b_3a_c253d. Additionally, restrict permissions to define and run sandboxed scripts to trusted users only, and monitor Jenkins environments for suspicious script activity.

Sources

- National Vulnerability Database (NVD) - Jenkins Security Advisory