CVE-2026-92127

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d

Description An issue exists where classpath entries in an item configuration are automatically approved when a user with Overall/Administer permission copies the item or updates the configuration via the REST API or CLI. This allows attackers who can define classpath entries to execute arbitrary code within the Jenkins controller JVM (Java Virtual Machine), which is the environment where the Jenkins application runs.

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.