CVE-2026-92126 in Script Security Plugin
Summary
by MITRE • 09/16/2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Jenkins Script Security Plugin serves as a critical defense mechanism for the Jenkins continuous integration and delivery platform by enforcing strict sandboxing rules around Groovy scripts executed within pipeline jobs or other scripted contexts. The vulnerability identified in versions 1415.v9a_f9b_3a_c253d and earlier represents a significant bypass of these security controls, specifically targeting the Builder annotation processing logic. In standard Java development using Project Lombok, the Builder annotation is used to automatically generate builder pattern code for classes. However, within the context of Jenkins script execution, this feature was exploited due to an insufficient validation mechanism regarding the builderStrategy member attribute. This flaw allows a user with permission to define and run sandboxed scripts, including Pipeline definitions, to manipulate how objects are instantiated during script evaluation.
The technical core of this vulnerability lies in the handling of the builderStrategy parameter within the @Builder annotation. When a Groovy script utilizes this annotation, it can specify a custom class name for the builder strategy via the builderStrategy member. In vulnerable versions, the Script Security plugin fails to validate whether the specified class is safe or restricted before allowing its use during object construction. If an attacker includes a malicious or dangerous class on the classpath of the Jenkins component responsible for evaluating the script, they can reference this class through the builderStrategy attribute. This effectively allows the execution engine to instantiate and utilize methods from that arbitrary class, bypassing the sandbox restrictions designed to prevent access to sensitive Java APIs and system resources.
This flaw has severe operational implications because it enables privilege escalation within the Jenkins environment. An attacker who possesses limited permissions, such as the ability to configure a job or run a pipeline script, can leverage this vulnerability to execute code outside the intended security boundary. By constructing objects using an arbitrary class from the classpath, the attacker gains access to methods and fields that are normally prohibited in sandboxed environments. This capability effectively neutralizes the primary purpose of the Script Security plugin, allowing for remote code execution or unauthorized data exfiltration depending on what classes are available in the Jenkins server's runtime environment. The risk is particularly acute in shared Jenkins instances where multiple users have script-writing privileges but should not have administrative access.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor if the bypass leads to data leakage. In terms of the MITRE ATT&CK framework for Enterprise, this behavior is consistent with Tactic Execution under Technique T1654 Script Jamming or more broadly T1059 Command and Scripting Interpreter where the attacker abuses legitimate scripting features to evade detection and security controls. The specific mechanism of abusing annotation processing reflects a failure in input validation regarding class references, which falls under CWE-20 Incorrect Search on Unique Key if interpreted as bypassing unique constraint checks for allowed classes, but more accurately fits CWE-94 when considering the injection of arbitrary code execution paths through metadata configuration.
To mitigate this vulnerability, organizations running Jenkins must immediately upgrade the Script Security Plugin to a version later than 1415.v9a_f9b_3a_c253d where the validation logic for builderStrategy has been hardened to reject references to arbitrary classes not explicitly whitelisted by administrators. Additionally, system administrators should review and restrict the classpath of Jenkins components to ensure that potentially dangerous utility libraries or internal framework classes are not accessible to script execution contexts. Implementing strict least-privilege policies for user permissions in Jenkins further reduces the attack surface by limiting who can define scripts that utilize advanced Groovy features like annotation-based object construction. Regular auditing of installed plugins and their versions is essential to maintain a secure CI/CD pipeline infrastructure against such bypass techniques.