CVE-2026-92122: Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to define and run sandboxed scripts, including Jenkins Pipelines. Successful exploitation can execute arbitrary code in the Jenkins controller JVM context.
Are sandboxed Pipelines affected?
Yes. The affected sandboxed-script functionality explicitly includes Pipelines when a script coerces a value to an interface and that value inherits a method with the same name as an interface method.