CVE-2026-92127: Jenkins Script Security Plugin vulnerability
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Script Security Pluginto a version that resolves this vulnerability.Fixed in 1415.v9a_f9b_3a_c253d - Compensating control
Restrict access to the Jenkins REST API/CLI and copying/updating item configurations to trusted administrators (limit users who have Overall/Administer permission) until the Script Security Plugin is upgraded.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Jenkins installations using Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier are exposed when item configurations can contain classpath entries and an Overall/Administer user copies the item or updates its configuration through the REST API or CLI.
What does an attacker need to exploit it?
An attacker must be able to define classpath entries in an item configuration. Exploitation then depends on an Overall/Administer user copying that item or updating its configuration through the REST API or CLI.
What is the impact of successful exploitation?
An attacker can execute arbitrary code in the context of the Jenkins controller JVM.