Executive brief
Jenkins Script Security Plugin is a component that controls which code operations are allowed to run safely within Jenkins. The plugin automatically approves classpath entries when administrators copy items or update configurations via API/CLI, allowing attackers to define malicious classpath entries that execute arbitrary code on the Jenkins server, potentially compromising the entire CI/CD infrastructure and any systems it can access.
Technical details
This is a privilege escalation and sandbox bypass vulnerability in Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier (CVE-2026-92127, SECURITY-3929). The plugin fails to validate classpath entries in item configurations when those configurations are copied or updated via REST API or CLI by users with Overall/Administer permission. An attacker with permissions to define classpath entries can inject arbitrary code that executes in the Jenkins controller JVM context. The vulnerability requires initial access (ability to define or modify item configurations through copy/API/CLI operations), but no user interaction beyond that. Jenkins has released version 1422.v06869826dd9b_ which properly validates classpath entries to remediate this issue.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Version 1422.v06869826dd9b_ released