CVE-2026-92129: Jenkins Script Security Plugin vulnerability
Published Sep 16, 2026
·Updated
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox.
Affected Software
1 affected component
Jenkins Script Security Plugin<=1415.v9a_f9b_3a_c253d
Event History
Sep 16, 2026
CVE Published
via MITRE·01:53 PM
Data Sourced
via MITRE·01:53 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs permission to define and run sandboxed scripts, including Jenkins Pipelines. This is not described as exploitable by an unauthenticated user or by someone who cannot run sandboxed scripts.
2
What is the impact of successful exploitation?
A permitted sandboxed-script author can bypass Jenkins sandbox protection and execute code outside the sandbox.
3
Which plugin versions are affected?
Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier are affected.