CVE-2026-92124

The Jenkins Script Security Plugin, which restricts what Groovy code can do when users run sandboxed scripts, mishandles type casts on collections: it checks the operations Groovy performs with the elements read from a collection that a script casts to another type, but actually applies the cast to the collection itself. An attacker who already has permission to define and run sandboxed scripts, including Pipelines (a low-privilege, authenticated position per the CVSS vector), can craft a script that exploits this mismatch to perform operations the sandbox never approved. The result is a complete sandbox bypass and execution of arbitrary code in the context of the Jenkins controller JVM, giving the attacker control over the Jenkins instance, its stored credentials, jobs, and build agents. Any Jenkins controller running Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier that grants sandboxed-script permissions to users is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

What to do: Update the Script Security Plugin via the Jenkins update center to the newest release published after 1415.v9a_f9b_3a_c253d (see the Jenkins security advisory for the fixed version). Until patched, restrict which users or roles can define and run sandboxed scripts and Pipelines, and review controller logs for suspicious sandboxed-script activity. Administrators should re-check that the plugin is updated on every controller, since it is commonly pulled in automatically as a Pipeline dependency.