CVE-2026-92123

The Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) fails to intercept Groovy operations performed on a null receiver — method calls, property and attribute accesses, and array accesses — leaving a gap in its sandbox protection mechanism (CWE-693). An attacker who already has permission to define and run sandboxed scripts, such as Pipeline jobs, can craft a script in which a null-receiver operation invokes privileged code that the sandbox never checks. Successful exploitation yields arbitrary code execution within the Jenkins controller JVM, giving the attacker full access to the controller, its stored credentials, and all jobs (CVSS 8.8 with high confidentiality, integrity, and availability impact). Any Jenkins controller running an affected plugin version where non-administrative users can author Pipelines or other sandboxed scripts is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and there are no reports of exploitation in the wild.

What to do: Update the Script Security Plugin to a release newer than 1415.v9a_f9b_3a_c253d as soon as a fixed version is published. Until then, restrict the permissions that allow users to create or edit Pipelines and other sandboxed scripts (e.g., Job/Configure and script-approval grants) to trusted users only, and review the sandbox approval list for overly broad approvals. Controllers that let anonymous or untrusted users define Pipelines carry the highest risk and should be prioritized, since exploitation requires authenticated script-authoring privileges.