# CVE-2026-92122: Jenkins Script Security Plugin sandbox bypass via proxy method coercion

Source: https://junglewise.ai/threats/cve-2026-92122-jenkins-script-security-plugin-sandbox-bypass-via-proxy-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92122 · Severity: high · CVSS 8.8 · Published 2026-09-16

Jenkins Script Security Plugin is a core security component that prevents user-written scripts and pipelines from performing unsafe operations. This vulnerability allows an attacker with permissions to write and execute scripts (including Jenkins Pipelines) to bypass this sandbox protection and run arbitrary code with Jenkins controller privileges. An exploit could lead to full compromise of the Jenkins instance and any systems it manages.

Technologies: [Jenkins Script Security Plugin](https://junglewise.ai/threats/technologies/script-security-plugin), [Jenkins Script Security](https://junglewise.ai/threats/technologies/script-security). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-92122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92122 being exploited in the wild.

**How severe is CVE-2026-92122?** High severity, with a CVSS score of 8.8, published 16 September 2026.

**Which products and versions are affected?** Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.

**Is there a fix for CVE-2026-92122?** A patch was published on 2026-09-16: Fixed in version 1422.v06869826dd9b_ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92122 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92122?** Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier. When Groovy coerces a value to an interface by creating a proxy, the plugin fails to intercept and check the method call if the underlying value inherits a method of the same name as the interface method. This allows an attacker with script-definition permissions to call arbitrary methods on the inherited implementation, bypassing sandbox checks. The attack requires the ability to define and run sandboxed scripts or Pipelines within Jenkins. The fix in version 1422.v06869826dd9b_ rejects such coercions when a method name collision exists.

## Affected products

- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier

## Timeline

- 2026-09-16: disclosed: Published in Jenkins Security Advisory 2026-09-16
- 2026-09-16: patched: Fixed in version 1422.v06869826dd9b_

## References

- [https://www.jenkins.io/security/advisory/2026-09-16/](https://www.jenkins.io/security/advisory/2026-09-16/)

## Related threats

- [Jenkins Script Security Plugin sandbox bypass with dynamic methods](https://junglewise.ai/threats/cve-2026-92129-jenkins-script-security-plugin-sandbox-bypass-with-dynamic)
- [Jenkins Script Security Plugin arbitrary JAR loading via double download](https://junglewise.ai/threats/cve-2026-92128-jenkins-script-security-plugin-arbitrary-jar-loading-via-double)
- [Jenkins Script Security Plugin classpath approval bypass](https://junglewise.ai/threats/cve-2026-92127-jenkins-script-security-plugin-classpath-approval-bypass)
- [Jenkins Script Security Plugin sandbox bypass via @Builder annotation](https://junglewise.ai/threats/cve-2026-92126-jenkins-script-security-plugin-sandbox-bypass-via-builder)
- [Jenkins Script Security Plugin sandbox bypass via @GroovyASTTransformationClass](https://junglewise.ai/threats/cve-2026-92125-jenkins-script-security-plugin-sandbox-bypass-via)