CVE-2026-92129

The Jenkins Script Security Plugin fails to apply sandbox checks to calls targeting methods that are added dynamically to a class at runtime, creating a protection-mechanism gap in its Groovy sandbox. An attacker who already has permission to define and run sandboxed scripts, such as Pipelines, can invoke such dynamically added methods to slip past the sandbox approval mechanism. Successful abuse yields execution of arbitrary code outside the sandbox on the Jenkins controller, with high impact to confidentiality, integrity, and availability. Any Jenkins instance running Script Security Plugin version 1415.v9a_f9b_3a_c253d or earlier is affected, though exploitation requires the attacker to hold script-authoring privileges, which is reflected in the high attack-complexity and low-privilege CVSS vector. No public proof of concept and no exploitation in the wild are currently known.

What to do: Update the Script Security Plugin to the latest release published in the Jenkins security advisory (any version newer than 1415.v9a_f9b_3a_c253d). Until patched, limit which users or groups can create or run sandboxed scripts and Pipelines, and review recently granted script permissions. Administrators should also audit Pipeline job definitions and run logs for unexpected script activity, keeping in mind the network-reachable but privileged nature of this flaw.