CVE-2026-92122

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier

Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the value inherits a method with the same name as an interface method, attackers with permissions to define and run sandboxed scripts, such as Pipelines, can bypass sandbox protections to execute arbitrary code within the Jenkins controller JVM (Java Virtual Machine). Approximately 1.4 million instances have been identified globally.

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.