CVE-2026-92126: Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to define and run sandboxed scripts, including Pipelines. Exploitation also depends on a suitable class being present on the classpath of the component evaluating the script.
Are sandboxed Pipeline scripts affected?
Yes. The issue explicitly includes Pipelines when an attacker can define and run them as sandboxed scripts.
What versions are affected?
Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier are affected.