CVE-2026-92124

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d

Description An issue exists where the plugin incorrectly validates operations performed by Groovy when a sandboxed script casts a collection to another type. Because the cast is performed on the collection itself rather than its elements, users with permissions to define and run sandboxed scripts, such as Pipelines, can bypass sandbox protections. This allows for the execution of arbitrary code within the context of the Jenkins controller JVM (Java Virtual Machine), which is the environment where the Jenkins application runs.

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.