CVE-2026-92123: Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to define and run sandboxed scripts, including Jenkins Pipelines. Successful exploitation allows arbitrary code execution in the context of the Jenkins controller JVM.
Are sandboxed Pipelines affected?
Yes. The affected sandbox handling applies to scripts including Pipelines, so sandboxing does not prevent exploitation by a user who can define and run such scripts.
How can I tell whether my Jenkins instance is affected?
Check the installed Jenkins Script Security Plugin version. Versions 1415.v9a_f9b_3a_c253d and earlier are affected.