CVE-2026-92122

Summary

The flaw allows attackers to bypass sandbox protection in Jenkins Script Security Plugin by coercing a value to an interface, executing arbitrary code in the Jenkins controller JVM. This is significant because it undermines the security measures intended to protect against unauthorized code execution.

Exploitability

Exploitation requires attackers to have permission to define and run sandboxed scripts, such as Pipelines. The difficulty lies in the attacker's ability to manipulate the script to bypass the sandbox.

Blast radius

If exploited, this flaw could lead to full compromise of the Jenkins controller JVM, allowing attackers to execute arbitrary code with the privileges of the Jenkins service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.