Executive brief
Jenkins Script Security Plugin is a component that enables secure execution of user-provided scripts within Jenkins by applying a sandbox. A flaw in versions 1415.v9a_f9b_3a_c253d and earlier causes the plugin to download and verify a JAR file once, then download it again without re-verifying before loading it. An attacker able to define classpath entries could exploit this race condition to substitute a malicious JAR between the two downloads, leading to arbitrary code execution within the Jenkins server itself.
Technical details
This vulnerability is a race condition and authorization bypass in the Jenkins Script Security Plugin's classpath handling. The plugin downloads a JAR file specified by URL, validates the download, but then performs a second download of the same JAR without re-validating it before loading the classpath entries. An attacker with permission to define classpath entries can intercept or manipulate the second download to substitute malicious code. The attack requires network-level manipulation (man-in-the-middle) or control over the JAR source, and execution occurs in the Jenkins controller JVM context with full privileges. Jenkins has patched this in version 1422.v06869826dd9b_ and later by implementing proper validation for all JAR loads.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed: CVE-2026-92128 disclosed in Jenkins Security Advisory 2026-09-16
- 2026-09-16: patched: Fixed in Script Security Plugin 1422.v06869826dd9b_ and later