CVE-2026-92131

Executive Summary

CVE-2026-92131 is a path traversal vulnerability (CWE-22) in the Jenkins Pipeline: Groovy Libraries Plugin, affecting version 805.va_fc79344957d and earlier. The plugin fails to restrict the library Pipeline step to a relative path within the SCM checkout and follows symbolic links that point outside the checkout, allowing an attacker with permission to configure Pipelines to read files in a resources directory and delete files in a test directory on the Jenkins controller filesystem. The CVSS v3.1 base score is 4.2 (Medium), reflecting high attack complexity and low confidentiality/integrity impact, but the ability to abuse legitimate Pipeline configuration privileges makes it a meaningful risk in multi-tenant or hardened Jenkins environments.

Technical Analysis

The Jenkins Pipeline: Groovy Libraries Plugin provides the library Pipeline step, which retrieves shared Groovy libraries from an SCM checkout (for example, a Git repository) so that pipeline scripts can reuse common code. According to the NVD description, two related weaknesses exist in affected versions (805.va_fc79344957d and earlier):

1. Path restriction failure — The plugin "does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout." In other words, the path supplied when loading a library is not confined to the checkout directory. This is the classic CWE-22 relative-path/absolute-path weakness: an attacker-controlled path component can escape the intended root directory and resolve elsewhere on the Jenkins controller filesystem.

2. Symbolic link following — The plugin "follows symbolic links to locations outside of the SCM checkout when retrieving the library." Even if a parent directory were otherwise confined to the checkout, a symlink placed inside the SCM checkout that points outside of it would still be traversed. This is the second, distinct traversal vector.

The two mechanisms combine into a confinement-bypass: the plugin resolves a library reference to a filesystem location that is outside the SCM checkout, both by accepting path traversal sequences and by resolving symlinks that escape the checkout root. The result is arbitrary read/write primitives constrained to whatever the Jenkins controller process can access:

• Read — files in a resources directory (data disclosure).
• Delete — files in a test directory (integrity destruction).

Attack surface: any user with the ability to "configure Pipelines" — i.e., a user whose Jenkins permissions allow creating or editing Pipeline jobs, including those that use shared libraries. This corresponds to the low privileges component of the CVSS vector (PR:L), and the network vector (AV:N) reflects that Jenkins job configuration and build triggering are normally performed over the network. Attack complexity is rated high (AC:H) because the exact path resolution and symlink behavior depends on repository contents, filesystem layout, and timing; no interactive user action is required (UI:N).

The CVSS scope is unchanged (S:U), consistent with an exploit that operates within the Jenkins controller's own trust boundary rather than crossing into another security authority. Impact is low on confidentiality (C:L) and integrity (I:L) — limited to reads of files in a resources directory and deletions in a test directory — with no availability impact (A:N). The vulnerability is a scoped filesystem-confusion issue rather than unrestricted code execution or full filesystem compromise.

No CNA title was supplied, and the NVD description is the sole authoritative technical source for this report. No public PoC or exploit code is known, and no Nuclei template exists, so the attack chain described below is framed at the vulnerability-class level rather than as a validated exploit.

Exploitation Scenarios

Because no public exploit exists and no CNA title is available, the following chains are inferred from the vulnerability class (CWE-22, path traversal with symlink following) and are restricted strictly to the mechanisms and file-system locations named in the NVD description.

1. Reconnaissance / target identification An attacker identifies a Jenkins instance exposing the Pipeline: Groovy Libraries Plugin at or below 805.va_fc79344957d, and confirms they hold a permission that allows configuring Pipelines (the PR:L precondition). Jenkins dashboards are commonly internet-facing on port 8080, and the Shodan dorks above assist in discovering such instances. The attacker also needs a shared library source they control — typically an SCM repository from which a library is fetched.

2. Triggering the flaw class (confinement bypass) The attacker configures a Pipeline that invokes the library step. The library path supplied to the step is not restricted to a relative path inside the SCM checkout. Consequently, the attacker can attempt to resolve a library location that escapes the checkout directory. In parallel, or alternatively, the attacker places (or relies on) a symbolic link inside the SCM checkout; because the plugin follows symlinks to locations outside the checkout when retrieving the library, the resolution can land outside the intended root. Both behaviors represent the same class of confinement failure: a library reference resolves to a filesystem location the plugin should never traverse.

3. Payload / execution at the vulnerability-class level The "payload" is not code execution but path selection. By choosing a traversal path or symlink target, the attacker directs the library-resolution logic at a filesystem location of interest. Successful resolution gives the attacker a filesystem access primitive on the Jenkins controller under the Jenkins process identity.

4. Post-exploitation impact Per the NVD description, the attacker can:

• Read files in a resources directory — disclosure of file content within that directory that the Jenkins process can read (C:L).
• Delete files in a test directory — destruction of files within that directory (I:L).

There is no stated impact on availability (A:N), and the scope remains unchanged. Because only public PoC evidence is absent, the exact syntax, encoding, and path forms that bypass confinement are unverified and are therefore not specified here. No function names, endpoints, or additional file paths beyond those in the NVD description are asserted.

Impact Assessment

Business impact. A user who can configure Pipelines can abuse the library step to read from a resources directory and delete from a test directory on the Jenkins controller. In the worst realistic case, the mentioned resources directory contains configuration or supporting data the attacker should not see, and the test directory contains artifacts whose deletion disrupts testing or build workflows. Deletion operations on build/CI infrastructure can be difficult to detect as malicious versus normal job cleanup.

Affected systems. Jenkins controllers running the Pipeline: Groovy Libraries Plugin at version 805.va_fc79344957d or earlier. The exposure is only exploitable by authenticated users who can configure Pipelines, so internet-facing but locked-down instances are lower risk than multi-tenant instances where many users hold Pipeline-configuration rights.

Blast radius. Scope is unchanged (S:U): the flaw does not cross a documented security boundary. Confidentiality and integrity impacts are both rated Low (C:L/I:L) and availability impact is None (A:N), which is why the base score is 4.2. There is no evidence of remote code execution, credential theft, or lateral movement from the description alone. The principal risk is integrity loss in test directories and limited disclosure from resources directories, amplified by the fact that no patch is currently available.

Detection Guidance

Sigma Rule

title: Jenkins Groovy Libraries Plugin Path Traversal via library Step
id: 3f9c1a2e-7b4d-4e21-9c8a-jenkins92131
status: experimental
description: Detects suspicious library step usage or Jenkins controller log entries consistent with path traversal in the Jenkins Pipeline Groovy Libraries Plugin (CVE-2026-92131).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92131
author: valtersit.com
date: 2026-01-01
logsource:
  product: jenkins
  service: controller
detection:
  selection_path:
    message|contains:
      - 'library '
      - 'resources'
      - 'test'
      - '../'
      - '..\\'
  selection_keywords:
    message|contains:
      - 'Groovy Libraries'
      - 'library step'
      - 'Failed to load library'
  condition: selection_keywords or (selection_path and selection_keywords)
falsepositives:
  - Legitimate shared library loads referencing directories named resources or test
level: medium
tags:
  - attack.t1190
  - cve.2026.92131

YARA Rule

rule CVE_2026_92131_Jenkins_Groovy_Libraries_Traversal
{
    meta:
        description = "Detects Pipeline scripts or log artifacts referencing library step path traversal consistent with CVE-2026-92131"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92131"
        severity = "medium"

    strings:
        $lib  = "library" ascii wide nocase
        $tra1 = "../" ascii wide
        $tra2 = "..\\" ascii wide
        $res  = "resources" ascii wide nocase
        $tst  = "test" ascii wide nocase
        $jen  = "Groovy Libraries" ascii wide nocase

    condition:
        $lib and ($tra1 or $tra2 or $res or $tst) and $jen
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92131 Jenkins Groovy Libraries Plugin Path Traversal Attempt"; flow:to_server,established; http.uri; content:"/job/"; content:"library"; distance:0; nocase; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/Ui"; reference:cve,2026-92131; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92131; classtype:attempted-recon; sid:2026092131; rev:1;)

Elastic Detection

process where process.name == "java" and
  process.args : "*jenkins*" and
  process.args : "*library*" and
  (process.args : "*../*" or process.args : "*..\\*" or process.args : "*resources*" or process.args : "*test*")

Splunk SPL Query

index=jenkins sourcetype=jenkins:log
| search ("library" AND ("../" OR "..\\" OR "resources" OR "test"))
| rex field=_raw "(?<libpath>(?:\.\.\/|\.\.\\)[^\s\"']+)"
| stats count by host, user, libpath
| where count > 0
| table host, user, libpath, count

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92131,">
  <rule id="921310" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">library</field>
    <match>\.\./|\.\.\\|resources|test</match>
    <description>CVE-2026-92131: Possible Jenkins Groovy Libraries Plugin path traversal via library step</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source, no vendor fix, no workaround identified in the provided data).

1. Immediate mitigations

   • Restrict the ability to configure Pipelines to the smallest possible set of trusted users; the vulnerability requires the PR:L privilege of configuring Pipelines.
   • Where feasible, disable or remove the Pipeline: Groovy Libraries Plugin if shared Groovy libraries are not actively required, eliminating the vulnerable library step surface.
   • Isolate the Jenkins controller so that repository checkouts and resulting filesystem operations occur on an agent rather than the controller, limiting what a traversal can reach. (Note: the description states impact is to the Jenkins controller filesystem.)
   • Monitor and alert on unexpected reads from resources directories and deletions in test directories on the Jenkins controller filesystem.

2. Patch / upgrade steps

   • Track the Jenkins security advisories and the NVD record for CVE-2026-92131 for a fixed plugin version once released. No fixed version is currently documented in the provided data.
   • Whenever a new version of the Pipeline: Groovy Libraries Plugin becomes available, upgrade immediately and re-validate pipeline library loading behavior.
   • Keep Jenkins core and all plugins current; confirm the plugin version no longer reports 805.va_fc79344957d or earlier.

3. Long-term hardening

   • Enforce least privilege on all Jenkins permissions, especially job/Pipeline configuration, and audit who holds these rights.
   • Adopt a controller/agent architecture so untrusted pipeline operations execute on isolated agents rather than the controller.
   • Validate and normalize library paths in custom shared-library workflows where possible, reject absolute paths and traversal sequences, and avoid relying on symlinks inside SCM checkouts.
   • Deploy file-integrity monitoring on Jenkins controller directories to detect unauthorized reads/deletions.

References

• NVD — CVE-2026-92131: https://nvd.nist.gov/vuln/detail/CVE-2026-92131
• Jenkins Security Advisories (monitor for the plugin fix): https://www.jenkins.io/security/advisories/
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"): https://cwe.mitre.org/data/definitions/22.html
• Jenkins Pipeline: Groovy Libraries Plugin: https://plugins.jenkins.io/pipeline-groovy-lib/
• CISA Known Exploited Vulnerabilities Catalog (currently does NOT list CVE-2026-92131): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: No evidence. CISA KEV listing is NO, no public PoC, no Nuclei template, and no exploit code were identified in the provided data.