CVE-2026-92127

The Jenkins Script Security Plugin up to and including 1415.v9a_f9b_3a_c253d automatically approves pending classpath entries in an item's configuration whenever a user with Overall/Administer permission copies that item, or saves its configuration through the REST API or CLI. An attacker who holds Item/Configure permission on a job (for example, a non-admin user able to edit sandboxed Pipelines) can plant a malicious classpath entry and wait for any administrator to copy the item or update its config remotely, at which point the entry is silently trusted. This yields arbitrary code execution inside the Jenkins controller JVM, giving the attacker full control over the controller, its credentials, and all jobs. Any Jenkins controller running an affected version of the plugin where non-administrators can define classpath entries is exposed. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Upgrade the Script Security Plugin to a release newer than 1415.v9a_f9b_3a_c253d as published in the Jenkins security advisory. Until patched, restrict Item/Configure permission to trusted users, review pending classpath entries in the in-process script approval and classpath approval screens under Manage Jenkins, and refrain from copying items or editing job configurations via REST API or CLI with admin accounts. Audit job configurations for classpath entries submitted by untrusted users.