CVE-2026-92126

The Jenkins Script Security Plugin, which enforces sandbox restrictions on user-written Groovy scripts, fails to reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing a sandbox bypass. An attacker who already has permission to define and run sandboxed scripts — typically authenticated users able to create or edit Pipelines — can craft a script that references a suitable 'gadget' class on the classpath of the component evaluating the script, causing that code to run outside the sandbox. Successful exploitation yields arbitrary code execution on the Jenkins controller, beyond the limits the sandbox is meant to enforce. Any Jenkins instance running Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier that lets non-administrator users write sandboxed Pipelines or scripts is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no CVSS score has been assigned; a patch is indicated among Jenkins' recent batch of plugin fixes.

What to do: Update the Script Security Plugin to the latest release (any version newer than 1415.v9a_f9b_3a_c253d). Until patched, restrict which users can define or run sandboxed Pipelines/scripts and audit job-creation and script-approval permissions on the controller. Admins should also review existing Pipeline definitions and script approvals for unexpected @Builder annotation usage.