CVE-2026-92123

Executive Summary

CVE-2026-92123 is a high-severity sandbox bypass vulnerability in the Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier). The plugin fails to intercept operations performed on a null receiver—specifically method calls, property/attribute accesses, and array accesses—allowing attackers with permission to define and run sandboxed scripts (including Pipelines) to escape the Groovy sandbox and execute arbitrary code in the context of the Jenkins controller JVM. This grants full control over the Jenkins controller, enabling system command execution, credential theft, and lateral movement within the CI/CD infrastructure.

Technical Analysis

The vulnerability resides in the Jenkins Script Security Plugin, which is responsible for sandboxing Groovy scripts executed in Jenkins Pipelines and other scripted contexts. The sandbox works by intercepting and approving or rejecting method calls, property accesses, and array operations through an interceptor mechanism (typically a Groovy Interceptor or similar AST transformation).

The core flaw, classified as CWE-693 (Protection Mechanism Failure), is that the plugin does not apply its interception logic to operations performed on a null receiver. In Groovy and Java, a "receiver" is the object on which a method is invoked or a property is accessed. When the receiver is null, operations that would normally be intercepted by the sandbox are instead executed directly, bypassing the security checks entirely.

This means that an attacker with the ability to define and run sandboxed scripts can craft a script that performs method calls, property accesses, or array accesses on a null receiver. Because the sandbox does not intercept these operations, the attacker can invoke methods or access properties that would otherwise be blocked, effectively escaping the sandbox. The exact mechanism by which a null receiver is leveraged to execute arbitrary code (e.g., via Groovy's null-safe operators, static context manipulation, or reflection) is not detailed in the available description. However, the impact is clear: arbitrary code execution in the Jenkins controller JVM.

The attack surface is the Jenkins script console, Pipeline definitions, and any other feature that allows users to define and run sandboxed Groovy scripts. The vulnerability requires the attacker to have permission to define and run such scripts—typically a user with Job/Configure or Overall/Read and script approval permissions. This is a common privilege level for developers in CI/CD environments.

Exploitation Scenarios

Reconnaissance: The attacker identifies a Jenkins instance with the Script Security Plugin version 1415.v9a_f9b_3a_c253d or earlier. This can be done by fingerprinting the Jenkins version and plugin versions via the /systemInfo endpoint, the Jenkins CLI, or by observing the X-Jenkins header. The attacker needs an account with permission to create or modify a Pipeline job or access the script console.

Triggering the flaw: The attacker creates a new Pipeline job or modifies an existing one and inserts a Groovy script that performs a method call, property access, or array access on a null receiver. Because the sandbox does not intercept these operations, the script executes without triggering the sandbox's approval mechanism. The exact payload structure is not detailed in the NVD description, but it leverages the null receiver to bypass the interceptor.

Payload/execution: Once the sandbox is bypassed, the attacker can execute arbitrary code in the Jenkins controller JVM. This could involve invoking Runtime.getRuntime().exec() or equivalent Groovy constructs to run system commands, reading files, or interacting with the Jenkins API to extract credentials. The attacker may chain this with existing Groovy capabilities to achieve full remote code execution.

Post-exploitation: With code execution on the Jenkins controller, the attacker can steal credentials stored in Jenkins (e.g., cloud provider keys, SSH keys, API tokens), modify build jobs to inject malicious code into software artifacts, pivot to other systems accessible from the controller, or install persistent backdoors. The blast radius includes all projects, credentials, and connected systems managed by the Jenkins instance.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): Low complexity; no special conditions required.
• Privileges Required (PR:L): The attacker needs low privileges—specifically, permission to define and run sandboxed scripts.
• User Interaction (UI:N): No user interaction required.
• Scope (S:U): The impact is confined to the vulnerable component (Jenkins controller JVM).
• Confidentiality (C:H): High impact—full disclosure of sensitive data (credentials, source code, etc.).
• Integrity (I:H): High impact—attacker can modify builds, artifacts, and configurations.
• Availability (A:H): High impact—attacker can disrupt CI/CD operations, delete jobs, or crash the controller.

The EPSS score is 0.00585 (46.6th percentile), suggesting a moderate likelihood of exploitation in the wild. However, no public PoC or exploit code is currently available, and CISA KEV does not list this CVE. The business impact is severe: Jenkins is a critical component in many software supply chains, and a compromise can lead to supply chain attacks, data breaches, and lateral movement into production environments.

Detection Guidance

Sigma Rule

title: Jenkins Script Security Sandbox Bypass via Null Receiver
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects attempts to exploit CVE-2026-92123 by identifying Groovy script patterns that perform operations on null receivers, bypassing the Jenkins Script Security sandbox.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: jenkins
  service: script-security
detection:
  selection:
    EventID: 'SCRIPT_SECURITY'
    ScriptText|contains:
      - 'null.'
      - 'null?.'
      - 'null['
  condition: selection
falsepositives:
  - Legitimate scripts that handle null values safely (e.g., null checks)
level: high
tags:
  - attack.t1190
  - cve.2026.92123

YARA Rule

rule CVE_2026_92123_Jenkins_Sandbox_Bypass
{
    meta:
        description = "Detects Groovy script patterns exploiting null receiver sandbox bypass in Jenkins Script Security Plugin"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-92123"
        severity = "high"

    strings:
        $s1 = "null." ascii wide
        $s2 = "null?." ascii wide
        $s3 = "null[" ascii wide

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92123 Jenkins Script Security Sandbox Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/createItem"; http_uri; content:"script"; http_client_body; content:"null."; http_client_body; sid:1000001; rev:1; reference:cve,2026-92123;)

Elastic Detection

sequence by host.name
  [process where event.type == "start" and process.name == "java" and process.args : "*jenkins*"]
  [network where destination.port == 8080 and network.protocol == "http" and http.request.method == "POST" and url.path == "/createItem" and http.request.body : "*null.*"]

Splunk SPL Query

index=jenkins sourcetype=jenkins:script_security
| search script_text="*null.*" OR script_text="*null?.*" OR script_text="*null[*"
| stats count by user, job_name, script_text
| where count > 0

Wazuh OSSEC Rule

<group name="jenkins,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="script_text">\.null\.|null\?\.|null\[</field>
    <description>CVE-2026-92123: Jenkins Script Security sandbox bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). No vendor fix or workaround details are available.

1. Immediate Mitigations:

   • Restrict access to Jenkins script approval and Pipeline creation to trusted users only.
   • Disable the script console for non-admin users.
   • Monitor Jenkins logs for suspicious Groovy script patterns, especially those involving null receivers.
   • Implement network segmentation to limit access to Jenkins controllers.

2. Patch/Upgrade Steps:

   • If a patched version of the Script Security Plugin is released, upgrade immediately. Check the Jenkins plugin repository for updates.
   • Since patch confidence is low, verify the patch's effectiveness independently or apply compensating controls.
   • For now, consider disabling the Script Security Plugin's sandbox for untrusted users (though this is a temporary workaround with its own risks).

3. Long-Term Hardening:

   • Enforce least privilege: users who can define scripts should not have admin rights.
   • Use Jenkins' Role-Based Access Control (RBAC) to limit who can run scripts.
   • Regularly audit plugins for vulnerabilities and apply updates.
   • Consider using ephemeral, isolated agents for builds to reduce the impact of a controller compromise.
   • Implement additional sandboxing (e.g., containers, SELinux) for Jenkins controllers.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-92123
2. Jenkins Security Advisories: https://www.jenkins.io/security/advisories/
3. Jenkins Script Security Plugin Documentation: https://plugins.jenkins.io/script-security/
4. MITRE CWE-693: https://cwe.mitre.org/data/definitions/693.html
5. EPSS Score: https://www.first.org/epss/ (score 0.00585, 46.6th percentile)

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-92123. No public PoC or exploit code is available.