CVE-2026-92129

Executive Summary

CVE-2026-92129 is a sandbox-escape vulnerability in the Jenkins Script Security Plugin affecting versions up to and including 1415.v9a_f9b_3a_c253d. The plugin fails to check calls from sandboxed scripts to methods that are added dynamically to a class at runtime, allowing an attacker who already holds permission to define and run sandboxed scripts (including Pipeline jobs) to bypass the Groovy sandbox and execute arbitrary code outside it. The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and no patch, public PoC, Nuclei template, or KEV entry currently exists.

Technical Analysis

The Jenkins Script Security Plugin is the component that enforces the Groovy sandbox for Jenkins Pipelines and other in-product scripting. Its central control is a whitelist/approval mechanism: when a script attempts to invoke a method, constructor, field, or property access, the plugin intercepts that operation and verifies it against an allowlist of signatures before permitting execution. If the target is not approved, the call is rejected and the script must be re-approved by an administrator.

The core defect described in the NVD text is that the plugin "does not check calls from sandboxed scripts to methods added dynamically to a class at runtime." In Groovy and on the JVM, a class's effective set of methods can be extended after the class is loaded — for example through runtime method injection or the use of language features that mutate the method table of a class dynamically. The sandbox checker operates on a static, approval-based view of known callable signatures at the moment of interception. When a method is not present in that checked view (because it was introduced dynamically at runtime rather than being a statically resolvable member), the sandbox validation has no recorded signature to evaluate against. The result is that the invocation to the dynamically added method is not subjected to the same approval/signature verification that governs ordinary method calls.

Because the sandbox's enforcement relies on signature inspection at the call-check boundary, any invocation path that skips or evades that signature lookup effectively escapes the sandbox. This is exactly the condition described: a call to a method that exists only at runtime is not checked, so a script author can route execution through such a dynamically defined member and reach unrestricted code, executing outside the sandbox.

The vulnerability class is a sandbox/security-control bypass (CWE-693, Protection Mechanism Failure). The attack surface is the script execution and approval pathway of Jenkins — specifically any interface that permits defining and running sandboxed scripts, including Jenkins Pipeline definitions. The privilege requirement is substantive: the attacker must already possess the permission to define and run sandboxed scripts (PR:L, reflected by a CVSS privilege metric requiring authentication as a low-privileged user). This is not a pre-auth or unauthenticated vulnerability (AV:N, AC:H, PR:L, UI:N). Successful exploitation yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

No specific class names, method names, or code paths beyond the plugin's described responsibility are introduced here, as the source data provides no such detail. The precise Groovy construct that adds methods dynamically is not disclosed in the supplied description; the mechanism above is derived strictly from the stated behavior that calls to dynamically added methods are not checked.

Exploitation Scenarios

This section describes the attack chain at the vulnerability-class level. No public PoC is available (PoC status: None), and no exploit code, Nuclei template, or in-the-wild evidence has been reported. The chain below is inferred from the vulnerability class and the exact wording of the NVD description.

1. Reconnaissance / target identification. The attacker identifies a reachable Jenkins instance (commonly exposed via an HTTP dashboard, frequently on ports 8080 or 443 when reverse-proxied). The attacker must be able to authenticate to Jenkins and must hold a role that includes the permission to define and run sandboxed scripts — for example a user permitted to author Pipeline jobs or other scripted content. Because the CVSS privilege metric is PR:L, this is a low-privileged authenticated actor, not an anonymous user.

2. Triggering the flaw. The attacker creates or modifies sandboxed script content (a Pipeline or another sandboxed script) such that it invokes a method that is added to a class dynamically at runtime. Because the Script Security Plugin does not check calls to methods that are added dynamically, the normal approval/signature verification is not applied to that invocation, and the script is not blocked at the sandbox boundary.

3. Payload/execution method. Routing the call through the unchecked dynamic method lets script logic proceed outside the confinement of the sandbox. At the class level, this means the script executes code without passing through the sandbox checks — the attacker has thereby broken out of the sandbox and can execute code outside it. No specific method name or code pattern is asserted here, because none is supplied in the source data; the operative fact is that an unchecked dynamically added method provides the escape primitive.

4. Post-exploitation impact. Once outside the sandbox, the attacker executes code in the Jenkins controller's context. Per the CVSS vector, all three impact metrics are High: confidentiality (C:H), integrity (I:H), and availability (A:H). Concretely, the attacker can read data accessible to the Jenkins process, modify it, and disrupt availability, affecting the Jenkins controller and any secrets, credentials, job definitions, or build artifacts it can reach. The scope metric is Unchanged (S:U), indicating the impact is scored within the security authority of the vulnerable component.

Stealth note: because the bypass depends on a parser/loader-behavior edge case rather than an obvious malicious signature, text-based inspection of script source may not flag the activity. Detection therefore leans on Jenkins audit/script-approval telemetry and process-level monitoring rather than simple string matching.

Impact Assessment

Business impact is significant for organizations running Jenkins with users authorized to create or run Pipeline/scripted jobs. The plugin is intrinsic to the Jenkins Pipeline and script-sandbox model, so any deployment that relies on the Groovy sandbox as a containment boundary is exposed to an authenticated low-privileged actor who can define and run sandboxed scripts.

CVSS v3.1 subscores and their meaning for this CVE:

• Attack Vector (AV:N) — exploitable over the network; no physical or adjacent access required.
• Attack Complexity (AC:H) — exploitation of a parser/loader edge case is not trivial; the attacker must construct script content that reaches the dynamically added method.
• Privileges Required (PR:L) — attacker needs a low-privileged authenticated account with scripting permissions. This substantially narrows the population of viable attackers to insiders, CI/CD users, and anyone who has obtained such an account.
• User Interaction (UI:N) — no separate victim interaction is needed beyond the attacker's own actions.
• Scope (S:U) — impact confined to the vulnerable component's security authority.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H) — full compromise of data, data integrity, and availability within the Jenkins context.

Blast radius: the Jenkins controller and the resources it can access. Sandbox escape on a Jenkins controller can expose credentials and secrets managed by Jenkins, enable tampering with build pipelines and artifacts, and allow disruption or destruction of CI/CD operations. Because Jenkins is commonly integrated with VCS, artifact repositories, and deployment systems, compromise of the controller can have downstream supply-chain implications even though this CVE is scored S:U. There is currently no evidence of mass exploitation (no KEV, no public exploit), which tempers immediate operational urgency while leaving the underlying risk high for homelab-to-enterprise deployments that enable untrusted Pipeline authoring.

Detection Guidance

Sigma Rule

title: Jenkins Script Security Sandbox Escape via Dynamic Method Call (CVE-2026-92129)
id: 5f1c9b2a-7d4e-4b9a-9c3e-2a1b8f6d0e11
status: experimental
description: Detects Jenkins audit/script-security events indicative of attempts to invoke methods added dynamically to a class at runtime from sandboxed scripts, consistent with the CVE-2026-92129 sandbox bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92129
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: jenkins
  service: script_security
detection:
  selection_action:
    event_type:
      - 'script_approval'
      - 'script_security'
      - 'pipeline_script_run'
  selection_indicator:
    message|contains:
      - 'dynamic'
      - 'setProperty'
      - 'invokeMethod'
      - 'added dynamically'
      - 'runtime'
      - 'sandbox'
  condition: selection_action and selection_indicator
fields:
  - user
  - job
  - message
falsepositives:
  - Legitimate plugins that generate dynamic methods and are fully approved
level: high
tags:
  - attack.t1190
  - attack.execution

YARA Rule

rule CVE_2026_92129_Jenkins_Dynamic_Method_Sandbox_Escape
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Jenkins Groovy/Pipeline script artifacts referencing dynamic method addition consistent with the CVE-2026-92129 sandbox escape."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92129"
        date = "2026-01-01"
        severity = "high"

    strings:
        $groovy = "groovy" nocase
        $pipeline = "@NonCPS" nocase
        $dynamic1 = "metaClass" nocase
        $dynamic2 = "setProperty" nocase
        $dynamic3 = "invokeMethod" nocase
        $dynamic4 = "ExpandoMetaClass" nocase
        $sandbox = "sandbox" nocase

    condition:
        (uint32(0) == 0x04034B50 or uint32(0) == 0x504B0304 or filesize < 5MB) and
        (($dynamic1 or $dynamic2 or $dynamic3 or $dynamic4) and ($groovy or $pipeline or $sandbox))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92129 Jenkins Script Security Sandbox Escape Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/job/"; http.uri; content:"/build"; http.request_body; content:"script"; nocase; http.request_body; content:"def "; nocase; http.request_body; content:"ExpandoMetaClass"; nocase; reference:cve,2026-92129; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92129; classtype:attempted-admin; sid:202692129; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=10m
  [ authentication where event.outcome == "success" ]
  [ process where process.parent.name : ("java", "jenkins") and
      process.name : ("sh", "bash", "cmd.exe", "powershell.exe") and
      process.args : ("/tmp/*", "/var/tmp/*", "curl*", "wget*", "base64*") ]

Splunk SPL Query

index=jenkins sourcetype=jenkins:script_security OR sourcetype=jenkins:audit
(script_security OR script_approval OR pipeline)
(message="*dynamic*" OR message="*setProperty*" OR message="*invokeMethod*" OR message="*ExpandoMetaClass*" OR message="*sandbox*")
| stats count values(message) as messages by user job _time
| where count > 0
| sort - _time

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92129">
  <rule id="100921" level="12">
    <decoded_as>json</decoded_as>
    <field name="log.source">jenkins</field>
    <match>dynamic|setProperty|invokeMethod|ExpandoMetaClass|sandbox bypass</match>
    <description>CVE-2026-92129: Possible Jenkins Script Security sandbox escape attempt via dynamically added method invocation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>jenkins_sandbox_escape,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict who may define and run sandboxed scripts. Because exploitation requires the permission to define and run sandboxed scripts (including Pipelines), the most direct mitigation is least-privilege: audit users and roles with Pipeline/script authoring rights and remove them where not strictly required. This raises the effective PR beyond the low-privileged bar assumed by the CVSS metric.
• Disable or tightly gate untrusted script execution where the business does not require in-Jenkins scripting, reducing the pool of accounts that could trigger the flaw.
• Treat all sandboxed script authors as potentially untrusted. The sandbox cannot be relied upon as a containment boundary for this issue in affected versions.
• Monitor Jenkins audit logs and Script Security approval events for anomalous or unexpected dynamic method activity (see Detection Guidance).

2. Patch/upgrade steps

• No patch is currently available from any tracked source (patch confidence 0/4). Verify vendor status directly via the Jenkins security advisories page for any future release that raises the Script Security Plugin above version 1415.v9a_f9b_3a_c253d.
• When a fixed Script Security Plugin version is released, upgrade the plugin through Jenkins Update Center, or by replacing the plugin artifact, and restart the controller. Confirm the resulting version exceeds the affected build.
• Re-review and reset script approval state after upgrading if the vendor advisory requires it.

3. Long-term hardening

• Apply least-privilege role design: minimize the number of principals with script authoring and job-creation rights on the Jenkins controller.
• Isolate the Jenkins controller from high-value secret stores and downstream deployment systems so that a controller compromise has a bounded blast radius; use agent isolation for builds.
• Enable and forward Jenkins audit logging to a SIEM, and alert on script-approval changes and unexpected process spawning from the Jenkins JVM.
• Maintain a patch discipline that tracks Jenkins plugin advisories, since plugin-level sandbox logic is a recurring source of bypasses.

References

• NVD — CVE-2026-92129: https://nvd.nist.gov/vuln/detail/CVE-2026-92129
• Jenkins Security Advisories (track for future Script Security Plugin fixes): https://www.jenkins.io/security/advisories/
• MITRE CWE-693, Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored for this CVE — no value available): https://www.first.org/epss/

Threat actor / exploit-in-the-wild evidence: None observed. This CVE is not in CISA KEV, no public PoC is available, no exploit code has been published, and no Nuclei template exists. The report does not assert any attribution or active campaign.