CVE-2026-92122 in Script Security Plugin
Summary
by MITRE • 09/17/2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier represents a critical security flaw within the mechanism used to enforce sandboxing for Groovy scripts executed on the Jenkins platform. This issue stems from an insufficient validation process when handling interface coercion operations performed by sandboxed scripts. Specifically, when a script coerces a value into a specific Java interface type, the plugin creates a proxy object to mediate access to that interface's methods. The core technical flaw lies in the fact that this proxy creation and method invocation logic fails to adequately verify whether the underlying object being proxied actually implements the target interface or merely possesses a method with an identical signature due to inheritance from a superclass or another unrelated class. This oversight allows for a bypass of the sandbox restrictions, which are designed to prevent untrusted scripts from accessing sensitive Jenkins APIs and executing arbitrary code on the controller JVM.
From a technical perspective, this vulnerability exploits the dynamic nature of Groovy's type coercion system combined with Java's proxy mechanisms. When a script attempts to cast or coerce an object to an interface, the Script Security plugin generates a dynamic proxy that intercepts method calls. The security check is intended to ensure that only whitelisted methods are accessible through this proxy. However, because the validation logic does not strictly confirm that the proxied object explicitly implements the target interface, it inadvertently permits access to any method present on the object's class hierarchy that shares a name with an interface method. This allows attackers who have been granted permission to define and run sandboxed scripts, such as Jenkins Pipelines, to invoke methods that should be restricted by the security policy. By leveraging this discrepancy, malicious actors can execute arbitrary code within the context of the Jenkins controller JVM, effectively neutralizing the protective boundaries established by the script security framework.
The operational impact of this vulnerability is severe, as it directly compromises the integrity and confidentiality of the Jenkins CI/CD environment. An attacker with access to create sandboxed scripts can escalate privileges from a restricted scripting context to full administrative control over the Jenkins controller. This capability enables the execution of arbitrary commands on the host system running Jenkins, potentially leading to complete server compromise, data exfiltration, or the installation of persistent backdoors. Furthermore, since Jenkins often manages sensitive build artifacts and credentials, this breach can have cascading effects across downstream systems connected to the CI/CD pipeline. The ability to bypass sandbox protections undermines trust in automated security checks and deployment processes that rely on isolated script execution environments.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on authorized actions within a specific context. It also relates to CWE-915 Improper Extension of Restricted Functionality, where the proxy mechanism is extended beyond its intended secure boundaries due to flawed validation logic. In terms of MITRE ATT&CK mapping, this exploit technique corresponds to Tactic TA0004 Privilege Escalation and specifically Technique T1621 Low-And-Slow Credential Access or potentially T1059 Command and Scripting Interpreter if the bypass is used to run further scripts. The attack vector typically involves an authenticated user with script creation permissions, making it a significant risk in environments where multiple teams share Jenkins instances without strict isolation policies.
To mitigate this vulnerability, organizations must immediately upgrade the Jenkins Script Security Plugin to version 1415.v9a_f9b_3a_c253d or later, which addresses the interface coercion validation logic. Administrators should also review and restrict permissions for users who can define sandboxed scripts, ensuring that only trusted individuals have access to create pipelines or script snippets. Implementing strict least-privilege principles within Jenkins configuration is essential to limit the blast radius of potential compromises. Additionally, monitoring logs for unusual activity in pipeline executions and employing runtime application self-protection (RASP) solutions can provide additional layers of defense against exploitation attempts targeting this specific flaw. Regular updates and patch management are critical to maintaining a secure CI/CD infrastructure against evolving threats that exploit such nuanced implementation details.