Jenkins Script Security CVE-2026-92122 Cluster: Upgrade to 1422.v06869826dd9b_

By AiCybr Editorial · Published September 18, 2026

Jenkins has released Script Security Plugin 1422.v06869826dd9b_ to fix a cluster of sandbox and classpath-approval vulnerabilities disclosed on September 16, 2026. The affected range is 1415.v9a_f9b_3a_c253d and earlier.

The highest-impact flaws allow users who already have permission to define and run sandboxed scripts, including Pipelines, to escape the Groovy sandbox and execute arbitrary code in the Jenkins controller JVM. The exposure therefore matters most on controllers where less-trusted users can create or modify Pipeline code.

Administrators running an affected Script Security build should upgrade to 1422.v06869826dd9b_ or later and review who can define or run Pipeline and other sandboxed Groovy code. Jenkins' September 16 advisory covers six sandbox-bypass CVEs plus two classpath-approval weaknesses in the same plugin release.

Fixed version and affected installations

This is a plugin-level update. Inventory the Script Security version installed on each Jenkins controller instead of relying only on the Jenkins core version.

CVE-2026-92122: interface coercion can bypass the sandbox

CVE-2026-92122 (SECURITY-3929) affects Groovy interface coercion. Groovy can coerce a value to an interface by creating a proxy that forwards interface calls to same-named methods on that value.

In affected Script Security versions, the sandbox fails to check the forwarded method when the value inherits a method with the same name as an interface method. A user able to define and execute sandboxed code can use that gap to escape the sandbox and run code in the controller JVM.

The fixed build rejects this coercion pattern when the value inherits a same-named method.

The other sandbox escapes fixed in the same release

The September 16 advisory documents several related weaknesses. Operators should treat the fixed Script Security build as the remediation boundary for the cluster instead of patching around one Groovy construct.

Jenkins rates the principal sandbox issues High. CVE-2026-92126 has higher attack complexity than the other principal sandbox paths, and CVE-2026-92129 requires a dynamically added method to have already been defined by code outside the sandbox.

Two classpath-approval flaws are also fixed

The same affected and fixed Script Security versions include two classpath-approval vulnerabilities.

CVE-2026-92127 concerns automatic classpath approval in configuration flows involving item copy, REST or CLI. Jenkins' advisory ties exploitation to an administrator-level configuration path involving Overall/Administer permission.

CVE-2026-92128 is a time-of-check/time-of-use issue involving JAR URLs. The affected implementation can download a JAR once for approval and again for loading, creating an opportunity for the loaded content to differ from the content that was approved.

These issues have different prerequisites from the Pipeline-author sandbox escapes, but they share the same fixed Script Security release.

Who should prioritize the update

The risk is highest where Jenkins is used as a shared CI service and Pipeline authors are not fully trusted as controller administrators. Common examples include centrally managed Jenkins installations serving multiple teams, delegated project administration, and environments that accept Pipeline definitions from repositories maintained by users with lower Jenkins privileges.

A successful sandbox escape crosses an important Jenkins trust boundary because code reaches the controller JVM. Controller credentials, build secrets, connected agents and administrative capabilities can make that execution context substantially more sensitive than an ordinary build step.

The advisory does not describe CVE-2026-92122 as an unauthenticated internet-facing RCE. The documented sandbox paths require the ability to define and run sandboxed scripts. That prerequisite should guide exposure triage without reducing the priority of patching shared controllers.

Remediation checklist

1. Open Manage Jenkins → Plugins and identify the installed Script Security version on every controller.
2. Upgrade affected installations to 1422.v06869826dd9b_ or later through the normal Jenkins plugin-management process.
3. Restart Jenkins if the plugin manager indicates that a restart is required for the update to take effect.
4. Review permissions that let users create, configure or run Pipeline and other sandboxed Groovy scripts.
5. Give shared controllers priority when Pipeline authors span multiple trust levels.
6. Review recent controller and Pipeline activity when an untrusted or compromised account had script-definition capability while the vulnerable plugin was installed.

Jenkins lists no evidence in the September 16 advisory that these Script Security vulnerabilities are being exploited in the wild. Those facts affect incident prioritization; the fixed release remains the direct remediation for vulnerable controllers.

Bottom line

Script Security 1422.v06869826dd9b_ closes a concentrated set of Groovy sandbox and classpath-approval weaknesses in versions 1415.v9a_f9b_3a_c253d and earlier. The most consequential cases let an authorized Pipeline or sandboxed-script author cross into arbitrary execution in the Jenkins controller JVM.

For shared Jenkins installations, the practical response is straightforward: upgrade the plugin, verify the installed build on every controller, and audit which users can define or run sandboxed code. That addresses the common remediation boundary across the September 16 Script Security cluster.

Sources

• Jenkins Security Advisory 2026-09-16
• Jenkins Script Security Plugin
• CyberPress: Jenkins plugin vulnerability coverage