CVE-2026-92127 in Script Security Plugin
Summary
by MITRE • 09/17/2026
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified as CVE-2024-23897 represents a critical security flaw within the Script Security Plugin for Jenkins, specifically affecting versions 1415.v9a_f9b_3a_c253d and earlier. This issue stems from an improper handling of classpath entries during item configuration operations such as copying items or updating configurations via the REST API or Command Line Interface. The core technical flaw lies in the automatic approval mechanism that bypasses necessary security checks when these administrative actions are performed by users possessing Overall/Administer permissions. By automatically approving new classpath entries without rigorous validation, the plugin inadvertently allows for the injection of malicious Java classes into the Jenkins controller's execution environment. This design oversight creates a direct pathway for attackers to achieve arbitrary code execution within the context of the Jenkins controller JVM, effectively compromising the integrity and confidentiality of the entire CI/CD infrastructure.
From an operational perspective, this vulnerability poses severe risks to organizations relying on Jenkins for software delivery pipelines. An attacker with Overall/Administer permissions can exploit this flaw by crafting a malicious item configuration that includes a classpath entry pointing to a remote or local jar file containing hostile code. When such a configuration is applied through the REST API or CLI, the Script Security Plugin automatically approves it without triggering the usual sandboxing restrictions. Consequently, the injected code executes with the same privileges as the Jenkins controller process. This level of access allows for complete system compromise, including data exfiltration, lateral movement within the network, and potential disruption of critical build and deployment processes. The ability to execute arbitrary code in this context undermines the fundamental security model of Jenkins, which relies on strict separation between user-defined scripts and core system operations.
The technical nature of this vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on actions performed by authenticated users. Furthermore, it relates to CWE-94 Code Injection, specifically through the manipulation of classpath entries to load unauthorized code modules. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where attackers use system utilities or scripts to execute commands on a target machine. It also intersects with T1203 Exploitation for Client Execution if the malicious class is delivered via client-side mechanisms, though in this specific Jenkins context, it primarily facilitates server-side execution through administrative interfaces. The vulnerability highlights the dangers of overly permissive automatic approval policies in security plugins designed to sandbox untrusted code.
To mitigate this risk, organizations must immediately upgrade the Script Security Plugin to version 1416.v9a_f9b_3a_c253d or later, where these issues have been addressed through stricter validation and control over classpath approvals. Administrators should also review existing configurations for any suspicious classpath entries that may have been introduced prior to patching. Implementing principle of least privilege is crucial; restricting Overall/Administer permissions to only those users who absolutely require them can reduce the attack surface. Additionally, enabling audit logging for configuration changes allows security teams to detect and respond to unauthorized modifications promptly. Regularly updating Jenkins plugins and core software ensures that known vulnerabilities are patched before they can be exploited by malicious actors seeking to compromise CI/CD pipelines.