Quick answers
- Is CVE-2026-92126 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92126 being exploited in the wild.
- How severe is CVE-2026-92126?
- High severity, with a CVSS score of 8.5, published 16 September 2026.
- Which products and versions are affected?
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier.
- Is there a fix for CVE-2026-92126?
- A patch was published on 2026-09-16: Version 1422.v06869826dd9b_ and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92126 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-92126?
- Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a sandbox bypass vulnerability (CWE-693) in the Jenkins Script Security Plugin. The root cause is insufficient validation of @Builder annotations during Groovy script compilation. Groovy's @Builder annotation can specify a custom builderStrategy class that is instantiated at compile time, before the sandbox is applied. The plugin fails to reject @Builder annotations with arbitrary builderStrategy values, allowing an attacker to instantiate arbitrary classes during compilation. An attacker must have permission to define and execute sandboxed scripts (e.g., Jenkinsfile Pipeline). The fix (version 1422.v06869826dd9b_ and later) validates and rejects @Builder annotations with untrusted builderStrategy classes during sandbox compilation.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Version 1422.v06869826dd9b_ and later