CVE-2026-92124: Jenkins Script Security Plugin sandbox bypass in collection casting

CVE-2026-92124 · Severity: high · CVSS 8.8 · Published 2026-09-16

Jenkins Script Security Plugin provides a sandbox that restricts Groovy scripts to safe operations, protecting Jenkins controllers from arbitrary code execution. A vulnerability in versions 1415.v9a_f9b_3a_c253d and earlier allows attackers with permission to write sandboxed scripts (including Pipeline jobs) to bypass sandbox checks during type casting of collections, enabling arbitrary code execution on the Jenkins server itself. This impacts any Jenkins instance allowing users to author Pipelines or Groovy-based scripts.

Technologies: Jenkins Script Security Plugin, Jenkins Script Security. Vendors: Jenkins.

Quick answers

Is CVE-2026-92124 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92124 being exploited in the wild.
How severe is CVE-2026-92124?
High severity, with a CVSS score of 8.8, published 16 September 2026.
Which products and versions are affected?
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.
Is there a fix for CVE-2026-92124?
A patch was published on 2026-09-16: Fixed in Script Security Plugin 1422.v06869826dd9b_ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92124 attacked?
It is attacked over the network.
Am I affected by CVE-2026-92124?
Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a sandbox bypass vulnerability in the Script Security Plugin's type-casting logic. When Groovy casts a collection to another type, the plugin checks operations on individual elements but then performs the cast on the collection object itself rather than on the checked elements. An attacker can override collection methods to supply different elements during the actual cast, bypassing sandbox inspection. The vulnerability affects Script Security Plugin versions through 1415.v9a_f9b_3a_c253d and requires the attacker to have permission to define and execute sandboxed scripts (Pipeline jobs, script execution steps, etc.). The fix in version 1422.v06869826dd9b_ performs the cast on the same elements that were checked, closing the bypass. No public exploitation has been reported, but the ease of exploitation for authorized users is high.

Affected products

  • Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier

Timeline

  • 2026-09-16: disclosed
  • 2026-09-16: patched: Fixed in Script Security Plugin 1422.v06869826dd9b_

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.