CVE-2026-92124 in Script Security Plugin
Summary
by MITRE • 09/16/2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as CVE-2024-23897 represents a critical security flaw within the Script Security Plugin for Jenkins, specifically affecting versions 1415.v9a_f9b_3a_c253d and earlier releases. This plugin is fundamental to Jenkins' security model, providing sandboxing capabilities that restrict Groovy scripts from performing dangerous operations such as arbitrary file system access or network connections. The core issue stems from a logic error in how the sandbox validates type casting operations on collections. When a sandboxed script attempts to cast an object read from a collection to a different type, the validation mechanism incorrectly applies the security check to the collection itself rather than the individual elements being accessed and cast. This misalignment allows attackers who possess permission to define and execute sandboxed scripts, including Jenkins Pipelines, to bypass these protective measures entirely.
From a technical perspective, this flaw exploits the gap between how Groovy handles dynamic typing and how the Script Security Plugin intercepts method calls for validation. In normal operation, when a script iterates over a collection and casts each element, the sandbox should verify that the specific cast operation is permitted under the current security policy. However, due to the described implementation defect, the plugin fails to inspect the actual object being processed during iteration. Instead, it validates against the container type, which may be permissible even if the individual elements require stricter controls. This oversight effectively neutralizes the sandbox's ability to prevent unauthorized method invocations or property accesses on specific objects within that collection, thereby creating a pathway for arbitrary code execution.
The operational impact of this vulnerability is severe because it compromises the isolation between untrusted user scripts and the Jenkins controller JVM. An attacker with access to create pipelines can leverage this flaw to execute commands directly on the host system running Jenkins. This could lead to full compromise of the CI/CD infrastructure, including theft of sensitive credentials stored in Jenkins secrets management, modification or deletion of build artifacts, and potential pivoting into internal network segments depending on the Jenkins deployment configuration. Since Jenkins often holds administrative privileges for various systems it manages, this breach can have cascading effects across an organization's entire software delivery pipeline.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it allows unauthorized execution of code within a restricted environment. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving Groovy or PowerShell depending on the scripting context used by the attacker. The exploitation relies on improper input validation logic where the security boundary is incorrectly applied at the wrong abstraction level of data processing.
Mitigation requires immediate upgrading to a patched version of the Jenkins Script Security Plugin that corrects this type casting validation logic. Organizations should also enforce strict least-privilege principles for users who can create pipelines, ensuring that only trusted personnel have write access to job configurations. Additionally, enabling audit logging and monitoring for unusual script execution patterns can help detect potential exploitation attempts before they result in full system compromise. Regular review of installed plugins and adherence to Jenkins recommended security practices are essential to maintaining a robust defense posture against such sandbox escape vulnerabilities.