CVE-2026-92122

The Jenkins Script Security Plugin fails to check method invocations made through the dynamic proxy that is created when a sandboxed script coerces a value to an interface, when the underlying value inherits a method whose name matches the interface method. An attacker who already has permission to define and run sandboxed scripts — most commonly users able to create or configure Pipelines on a shared Jenkins controller — can craft a script that abuses this coercion path to escape the Groovy sandbox. Successful exploitation yields arbitrary code execution inside the Jenkins controller JVM, which typically means full control of the controller, its credentials/secrets, and all connected build agents. Any Jenkins instance running Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier is affected, and because the plugin is a core dependency of Pipeline, that includes most modern Jenkins deployments. No public proof-of-concept, listing in CISA KEV, or confirmed in-the-wild exploitation is known at this time.

What to do: Update the Script Security Plugin to the first release published after this advisory (any version later than 1415.v9a_f9b_3a_c253d), which all controllers using Pipelines should receive promptly. In the meantime, restrict who can define and run sandboxed scripts — review users/groups with Item/Configure or Pipeline job-creation rights and Overall/RunScripts permission on shared controllers — and audit existing sandboxed jobs for scripts that coerce values to interfaces. Since exploitation requires script-running privileges, single-user or tightly restricted Jenkins instances face substantially lower practical risk than multi-tenant controllers.