Jenkins Script Security Plugin Vulnerability Allows Code Execution

CVE-2026-92126

What is CVE-2026-92126?

The Jenkins Script Security Plugin prior to version 1415.v9a_f9b_3a_c253d is susceptible to a security flaw that fails to appropriately restrict @Builder annotations. This vulnerability permits users with the ability to create and execute sandboxed scripts, including those in Pipelines, to potentially run malicious code outside of the intended sandbox environment. The attack exploits the builderStrategy member, allowing an arbitrary class specified by the attacker on the classpath to be utilized, posing a significant risk to system integrity and data security. Immediate actions should be considered to mitigate exposure.

References