CVE-2026-92127

Executive Summary

CVE-2026-92127 is an improper neutralization of special elements used in code generation ("Code Injection," CWE-94) vulnerability in the Jenkins Script Security Plugin, affecting version 1415.v9a_f9b_3a_c253d and earlier. The flaw causes the plugin to automatically approve classpath entries contained in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI. This allows an actor who is able to define classpath entries to achieve arbitrary code execution within the Jenkins controller JVM, resulting in full compromise of the Jenkins controller and, by extension, the CI/CD pipelines and credentials it manages. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no vendor patch has been evidenced.

Technical Analysis

The Jenkins Script Security Plugin is a core security control in Jenkins. Its central purpose is to prevent Jenkins administrators — who necessarily have broad configuration power — from inadvertently or maliciously executing unsandboxed Groovy code in the controller JVM by requiring that scripts and certain configuration elements be explicitly approved before they are executed. The plugin implements an approval mechanism that maintains a list of trusted signatures (typically hashes of method calls, class names, or other executable constructs) so that unapproved constructs are blocked at runtime.

CVE-2026-92127 describes a logic flaw in that approval mechanism: the plugin "automatically approves the classpath entries in an item configuration" under two specific operations:

1. When a user with the Overall/Administer permission copies an item (e.g., "Copy" action on a job/item), and
2. When a user with Overall/Administer permission updates that configuration through the REST API or CLI.

In other words, performing a routine administrative action (copying or programmatically updating an item) causes the plugin to bypass its own review workflow and auto-approve whatever classpath entries are present in the submitted configuration. Because classpath entries influence which classes are loaded and made available to script execution (for example, by Jenkins pipelines, shared libraries, or Groovy-based scripting), an attacker who can define those classpath entries can arrange for arbitrary classes to be placed on the classpath and then invoked, achieving arbitrary code execution in the context of the Jenkins controller JVM.

The vulnerability classification is CWE-94 (Improper Control of Generation of Code, "Code Injection"). The relevant technical properties are:

• Attack Vector: Network (AV:N). The REST API and CLI are network-accessible interfaces.
• Attack Complexity: Low (AC:L). No special conditions beyond defining classpath entries are required.
• Privileges Required: Low (PR:L). By CVSS convention, PR:L reflects that the actor must hold some privilege (Overall/Administer), but the auto-approval logic means the intended safety barrier of Script Security is nullified. The actor does not need to gain separate approval for the malicious construct.
• User Interaction: Required (UI:R). The administrative copy/update action must occur.
• Scope: Unchanged (S:U).
• Confidentiality / Integrity / Availability: High / High / High (C:H/I:H/A:H). Code execution in the controller JVM allows reading of all Jenkins secrets, modification of jobs and pipeline definitions, and denial of service.

Critically, the flaw does not require an external, unauthenticated attacker. The exploit path relies on an actor with the ability to define classpath entries in an item configuration. In many real-world Jenkins deployments, this capability is granted more broadly than Overall/Administer (e.g., to trusted developers who can configure jobs, or to automation tokens/API credentials). CVE-2026-92127 is therefore best characterized as a privilege-boundary bypass: administrative-level configuration actions that are supposed to be constrained by Script Security's approval workflow instead silently whitelist attacker-controlled executable content.

Note on data limitations: The NVD description does not name specific functions, classes, REST endpoints, or file paths involved in the flaw. Accordingly, this report does not invent them. The technical analysis above is bounded by the semantics of CWE-94, the Script Security Plugin's documented purpose, and the exact operations named in the description (copy; REST API/CLI update).

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class and the operations named in the NVD description. No specific function names, endpoints, or parameters beyond "classpath entries," "item configuration," "REST API," and "CLI" are asserted.

1) Reconnaissance / Target Identification The attacker identifies a Jenkins instance where they hold an account with the ability to define classpath entries in an item configuration (and ideally Overall/Administer, or a token with equivalent rights). Reconnaissance is passive: enumerating Jenkins instances (via the well-known dashboard title exposed through Shodan dorks above), identifying the Jenkins version, confirming the Script Security Plugin version is 1415.v9a_f9b_3a_c253d or earlier, and determining whether REST API or CLI access is enabled. Because the API/CLI is a first-class Jenkins management surface, an attacker with credentials can simply query build and plugin metadata to fingerprint the target.

2) Triggering the Flaw The attacker prepares an item configuration that includes malicious classpath entries. They then perform one of the two operations the plugin improperly auto-approves:

• Item copy: If the attacker has Overall/Administer, they copy an existing item whose configuration carries the malicious classpath entries. The plugin, on copy, automatically approves those classpath entries — bypassing the normal Script Security review.
• REST API / CLI update: Alternatively, the attacker submits an item configuration update through the Jenkins REST API or the CLI containing the classpath entries. The same auto-approval logic fires.

Because the approval happens automatically as a side effect of a legitimate administrative operation, there is no separate script-approval prompt that would normally block the malicious construct.

3) Payload / Execution (class level) Once the malicious classpath entries are approved, the executable content they reference becomes trusted and available on the classpath. Any subsequent invocation path that consumes those classpath entries (e.g., script or pipeline execution that loads classes from the configured classpath) can execute the attacker's code. At the vulnerability-class level: code injection via untrusted classpath resolution leads to arbitrary code execution in the Jenkins controller JVM. No specific class or method names are asserted because the CVE description does not provide them; the mechanism is the auto-approval of attacker-influenced classpath entries combined with normal classloading/invocation.

4) Post-Exploitation Impact Arbitrary code execution in the controller JVM yields the highest-value position in a Jenkins deployment. The attacker can:

• Read the Jenkins home directory and credentials store, including cloud credentials, deployment keys, and tokens used by pipelines.
• Modify or replace job/pipeline definitions to inject further malicious stages that run on agents, enabling lateral movement into build environments and downstream production systems.
• Establish persistence by modifying configuration or creating scheduled items.
• Conduct denial of service against the controller (S:U, A:H).

Because Jenkins controllers frequently hold credentials for source control, artifact repositories, cloud providers, and production deployment targets, the blast radius is potentially organization-wide supply-chain compromise.

Impact Assessment

CVSS 3.1 Base Score: 8.0 (High) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

• Confidentiality (High): Direct access to secrets stored in the controller, including credentials for downstream systems.
• Integrity (High): The attacker can alter configuration, jobs, and pipeline definitions, and inject code that runs on agents.
• Availability (High): Controller JVM code execution permits denial-of-service or destructive actions.
• Scope (Unchanged): The vulnerability's exploitation is scoped to the controller's security authority, though the practical consequences can extend to connected agents and external systems.

Blast radius: Any Jenkins controller running the affected Script Security Plugin (1415.v9a_f9b_3a_c253d or earlier) with an actor capable of defining classpath entries and performing item copies or API/CLI updates. Internet-exposed Jenkins controllers (see Shodan dorks) elevate risk.

Threat context: EPSS has not been scored by FIRST.org; no EPSS value is fabricated here. CVE-2026-92127 is not listed in CISA KEV, and there is no evidence of in-the-wild exploitation. No public PoC or exploit code is available. Absence of evidence is not evidence of absence; Jenkins is a perennial target, and the high CVSS score and the CI/CD supply-chain value make weaponization attractive once details become public.

Business impact: Successful exploitation is equivalent to administrative compromise of the build system. For organizations using Jenkins for production deployment, this can translate to unauthorized software releases, credential theft, and downstream customer impact. Regulatory and compliance exposure (CI/CD pipeline integrity, secrets management, SLSA-style supply chain controls) is significant.

Detection Guidance

Sigma Rule

title: Jenkins Script Security Plugin Classpath Auto-Approval via Item Copy or REST/CLI Update (CVE-2026-92127)
id: 3f9b8c1a-6d2e-4a77-9c11-8b7e5f0a1c2d
status: experimental
description: Detects Jenkins item copy or REST/CLI configuration updates that follow immediately after classpath entry definitions in item configuration, consistent with CVE-2026-92127 auto-approval behavior.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92127
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: jenkins
  service: audit
detection:
  selection_copy:
    event_type:
      - 'copyItem'
      - 'CopyItem'
    item_config_changed: true
  selection_api_cli_update:
    event_type:
      - 'updateItem'
      - 'configSubmit'
      - 'cli_update'
    source:
      - 'rest_api'
      - 'cli'
  selection_classpath:
    config_field|contains:
      - 'classpath'
  condition: (selection_copy or selection_api_cli_update) and selection_classpath
falsepositives:
  - Legitimate Jenkins administrators managing items with legitimate classpath entries
  - Automated configuration management tooling (Jenkins Configuration as Code, Terraform) that updates item configuration
level: high
tags:
  - attack.t1190
  - attack.t1059
  - cve.2026.92127

YARA Rule

rule CVE_2026_92127_Jenkins_ScriptSecurity_Classpath_AutoApprove
{
    meta:
        description = "Detects item configuration artifacts referencing classpath entries in Jenkins, relevant to CVE-2026-92127 Script Security Plugin auto-approval"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92127"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cp1 = "classpath" ascii wide nocase
        $cp2 = "Classpath" ascii wide
        $jenkins1 = "jenkins" ascii wide nocase
        $itemcfg1 = "config.xml" ascii wide
        $itemcfg2 = "Script Security" ascii wide nocase
        $shortname = "shortName" ascii wide
        $pluginver = "1415.v9a_f9b_3a_c253d" ascii wide

    condition:
        uint32(0) != 0x04034b50 and
        filesize < 10MB and
        $jenkins1 and
        (($cp1 or $cp2) and ($itemcfg1 or $itemcfg2 or $shortname or $pluginver))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92127 Jenkins Script Security Plugin Classpath Auto-Approval Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/configSubmit"; http.request_body; content:"classpath"; nocase; http.request_body; content:"Script Security"; nocase; classtype:attempted-admin; reference:cve,2026-92127; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92127; sid:202692127; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where host.os.type == "linux" and event.category == "authentication" and service.name == "jenkins" ]
  [ network where event.category == "network" and
      (http.request.method == "POST") and
      (url.path contains "configSubmit" or url.path contains "copy" or url.path contains "cli") and
      (http.request.body contains "classpath") ]

Splunk SPL Query

index=jenkins sourcetype=jenkins:audit (event_type=copyItem OR event_type=updateItem OR event_type=configSubmit OR uri_path="*/configSubmit*")
| search (config_classpath=* OR request_body="*classpath*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, item_name, event_type, uri_path
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| table first_seen, last_seen, src_ip, user, event_type, item_name, uri_path, count

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92127,">
  <rule id="100926" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">\.+</field>
    <field name="config_classpath">\.+</field>
    <description>CVE-2026-92127: Jenkins item configuration updated with classpath entries - possible Script Security Plugin auto-approval abuse</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>jenkins_script_security,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was supplied by the tracked sources for this CVE. The guidance below is derived from the CVE description and standard Jenkins hardening practice; it does not assert the existence of a vendor patch.

1. Immediate mitigations

   • Restrict who can define classpath entries. Treat the ability to set classpath entries in item configuration as equivalent to Overall/Administer, and audit role/permission assignments to ensure it is not granted to untrusted or broadly shared accounts.
   • Restrict REST API and CLI access. If the CLI is not required, disable or firewall it. Where the REST API must be exposed, require authenticated, least-privilege tokens and place the controller behind a VPN or zero-trust access proxy — do not expose Jenkins directly to the internet.
   • Audit for prior abuse. Review Jenkins audit logs for copyItem and configuration-update events involving classpath changes, and treat the controller as potentially compromised if suspicious entries are found (rotate all controller-stored credentials and secrets).
   • Freeze item configuration changes via API/CLI where operationally feasible until a fix is available, and require manual, reviewed changes through the UI.

2. Patch / upgrade steps

   • No patch is available per tracked sources. Monitor the Jenkins Security Advisories page and the NVD entry for CVE-2026-92127 for a fixed Script Security Plugin release. When a fixed version is published, upgrade the Script Security Plugin through the Jenkins Plugin Manager (Manage Jenkins → Plugins), then restart the controller.
   • Track the plugin version currently installed and compare against any fixed version once announced. Do not assume that upgrading Jenkins core alone resolves a plugin-level vulnerability — the Script Security Plugin must be updated.
   • Maintain an offline mirror or pinned version repository so that the fix can be deployed rapidly and reproducibly once released.

3. Long-term hardening

   • Adopt a zero-trust posture for CI/CD controllers: never expose Jenkins management interfaces to untrusted networks; enforce MFA and short-lived credentials.
   • Apply least privilege rigorously: segregate duties so that the permission to copy items or submit configuration through the REST API/CLI is confined to a small, monitored administrator group.
   • Enable and forward Jenkins audit logs to a SIEM, and implement the detection rules above.
   • Enforce script approval review discipline and regularly review the Script Security approval list for unexpected classpath entries.
   • Consider script/declarative pipeline restrictions, ephemeral controllers, and immutable infrastructure for build environments to reduce the persistence value of a controller compromise.
   • Subscribe to the Jenkins Security Advisories mailing list and maintain an SBOM covering Jenkins plugins to accelerate future response.

References

• NVD — CVE-2026-92127: https://nvd.nist.gov/vuln/detail/CVE-2026-92127
• Jenkins Security Advisories (monitor for a fixed Script Security Plugin release): https://www.jenkins.io/security/advisories/
• Jenkins Script Security Plugin documentation: https://plugins.jenkins.io/script-security/
• MITRE CWE-94 — Improper Control of Generation of Code ("Code Injection"): https://cwe.mitre.org/data/definitions/94.html
• FIRST EPSS — CVE-2026-92127 status: https://api.first.org/data/v1/epss?cve=CVE-2026-92127 (not yet scored as of this report)

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template are associated with CVE-2026-92127 in the supplied data. There is currently no evidence of active exploitation. Given the high CVSS score (8.0) and the strategic value of Jenkins controllers in software supply chains, organizations should assume weaponization is possible following public disclosure of technical details and should prioritize detection and permission-tightening accordingly.