CVE-2026-92132

Executive Summary

CVE-2026-92132 is an injection-class vulnerability in the Jenkins Gradle Plugin (version 2.19.1252.v15196b_5a_6e10 and earlier) in which the plugin requests build scan data from a URL extracted from the build log, even when a Develocity server URL has been configured globally. Because the plugin can be induced to connect to an attacker-controlled URL, an actor who can influence the contents of a build log can capture the Develocity access key stored in the Jenkins global configuration. The vulnerability is rated CVSS 3.1 base 5.4 (Medium severity), requires low privileges, and has no known public proof-of-concept or exploit code at the time of writing.

Technical Analysis

The Jenkins Gradle Plugin provides integration between Jenkins pipelines and Gradle-based builds, including the ability to parse and consume build scan links emitted during a build (build scans are produced by the Develocity plugin — formerly Gradle Enterprise — and are published to a Develocity server). For build scan publication to function, the Jenkins plugin maintains configuration that includes a Develocity server URL and an associated access key, both held in Jenkins' global configuration.

The flaw described in the NVD entry is fundamentally a trust-boundary / injection problem (CWE-74) rooted in the plugin's handling of the build scan link. According to the advisory, when the plugin detects a build scan link in the build log, it requests build scan data from that link even when a Develocity server URL is configured in the global configuration. In other words, the expected behavior — honoring the operator-configured, trusted Develocity server — is bypassed when a link is present in the build log. The plugin's subsequent outbound request follows the log-supplied URL instead.

Two properties make this exploitable:

1. Controllable input: The build log is not a trusted control channel. A user who can influence log output (for example, by contributing build scripts, build configuration, or job parameters that get echoed into the log) can place an arbitrary URL into the log in the position where the plugin looks for a build scan link.
2. Credential attachment: The request the plugin issues carries the Develocity access key from the Jenkins global configuration. When that request is directed to an attacker-specified URL, the credential is disclosed to the attacker. This is the classic result of letting an untrusted value select the destination of a credentialed request.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a network-reachable, low-complexity attack requiring only low privileges and no user interaction. The Confidentiality: Low and Integrity: Low ratings align with a targeted secret disclosure (the access key and any data readable with it) rather than wholesale system compromise; Availability: N indicates the flaw does not directly degrade availability.

Insufficient technical detail is available to describe the exact function, class, or HTTP request structure the plugin uses to fetch build scan data, or the precise format of the matching link within the log. Those implementation specifics are not stated in the provided advisory and are not fabricated here.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (CWE-74, untrusted-input-driven outbound request) and the NVD description. No public proof-of-concept exists; specific log markers, URL formats, and plugin internals are not asserted beyond what the advisory states.

1. Reconnaissance / targeting. The attacker identifies a Jenkins instance running the vulnerable Gradle Plugin. Candidates are Jenkins controllers that schedule Gradle builds and that have Develocity integration configured globally (i.e., a Develocity server URL plus an access key in the global configuration). Exposed Jenkins dashboards reachable over the network can be fingerprinted for the Gradle Plugin and for Gradle job usage.

2. Triggering the flaw class. The attacker obtains the low-privilege access the vector requires (PR:L) — for example, the ability to modify a Gradle build so that it writes an attacker-chosen URL into the build log where the plugin looks for a build scan link. Because the plugin honors the log-supplied link even though a trusted Develocity URL is configured globally, the operator-configured server no longer governs where the plugin sends its request.

3. Payload / execution at the vulnerability-class level. Once the attacker-controlled URL is present in the log, the plugin initiates an outbound request to that destination. The request carries the Develocity access key from the Jenkins global configuration. The attacker's endpoint (or an attacker-controlled redirect target) simply captures the inbound request and extracts the access key. No user interaction is needed for the credential to leave the environment — the plugin performs the request on its own.

4. Post-exploitation impact. With the captured access key, the attacker can interact with the legitimate Develocity server under the identity/entitlements granted to that key. Given the CVSS Integrity:Low / Confidentiality:Low scoring, impact is bounded but meaningful: unauthorized access to build scan data, potential ability to publish or alter scan-linked build data consistent with the key's permissions, and a stepping stone for supply-chain reconnaissance (build metadata, dependency graphs, and artifact provenance often visible through build scan systems).

This is a credential-exfiltration / SSRF-adjacent pattern (attacker-directed outbound connection), not a remote code execution flaw.

Impact Assessment

Primary impact — credential disclosure. The Develocity access key is the asset at risk. Because build scan systems aggregate build metadata, dependency and configuration data, that key may grant read (and possibly limited write) access to build intelligence depending on its entitlements. This is a supply-chain-relevant secret.

Blast radius. Any Jenkins controller running the affected Gradle Plugin with Develocity integration configured globally is in scope. The risk is highest in CI/CD environments where many users can influence build scripts or log content (shared controllers, multi-tenant Jenkins, or orgs accepting external contributions to Gradle build logic), because that is exactly the input path the flaw distrusts.

CVSS 3.1 subscores (base 5.4). AV:N — the plugin makes an outbound network request, reachable across network boundaries; AC:L — no special conditions beyond the vulnerable configuration; PR:L — attacker needs low privileges to influence the build log; UI:N — no user interaction; S:U — impact is scoped to the vulnerable component's authority; C:L — limited confidentiality loss (the access key plus what it unlocks); I:L — limited integrity impact; A:N — no availability impact.

Severity interpretation. Medium. It is not a "drop everything" RCE, but in CI/CD, capturing a signing-adjacent or build-system credential frequently warrants elevated handling because it can seed downstream supply-chain activity.

Detection Guidance

Sigma Rule

title: Jenkins Gradle Plugin Outbound Request to Non-Configured Develocity Host
id: 8f3c2e1a-9d4b-4f76-8a21-6c0e5b7d3a10
status: experimental
description: Detects Jenkins controller process making outbound HTTP(S) connections to hosts other than the configured Develocity server, consistent with CVE-2026-92132 credential capture via build-log-controlled scan link.
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
  # For Linux controllers, adapt to the equivalent auditd/Zeek logsource.
detection:
  selection_proc:
    Image|endswith: 'java.exe'
    # Jenkins controller JVM; narrow with CommandLine containing the Jenkins WAR/agent launch if available.
  selection_conn:
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
      - 8080
  filter_known_develocity:
    DestinationHostname:
      - 'develocity.example.internal'
      - 'gradle-enterprise.example.internal'
  condition: selection_proc and selection_conn and not filter_known_develocity
falsepositives:
  - Jenkins making legitimate outbound calls to plugin update sites, artifact repositories, or source control.
level: medium
tags:
  - attack.t1552.001
  - attack.t1071

Adapt the filter_known_develocity list to the operator's actual configured Develocity hosts and treat anomalies (unknown destination plus the Jenkins JVM as source) as the signal.

YARA Rule

rule CVE_2026_92132_Jenkins_Gradle_BuildScan_Link
{
    meta:
        description = "Detects Jenkins Gradle Plugin JARs / build logs referencing build scan link handling that may be abusable under CVE-2026-92132"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-92132"
        severity = "medium"
    strings:
        $scan1 = "build scan" ascii nocase
        $scan2 = "buildScan" ascii nocase
        $dv1   = "develocity" ascii nocase
        $dv2   = "gradle enterprise" ascii nocase
        $key1  = "accessKey" ascii nocase
        $key2  = "access key" ascii nocase
        $plug  = "gradle" ascii nocase
    condition:
        filesize < 50MB and
        (2 of ($scan*) and 1 of ($dv*)) and
        1 of ($key*) and
        $plug
}

This rule targets JAR artifacts, plugin bundles, and build-log files containing the combination of build-scan and Develocity/access-key indicators. Tune the file-size ceiling and offset windows to your environment.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92132 Jenkins Gradle Plugin Develocity Access Key Exfiltration Attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Authorization"; nocase; http.header; content:"Bearer"; nocase; http.uri; content:"/api/"; nocase; classtype:attempted-recon; reference:cve,2026-92132; reference:url,valtersit.com; sid:202692132; rev:1;)

This watches for outbound HTTP requests that carry an authorization bearer token to a /api/ path from the Jenkins controller, which is the behavior-class signature of the plugin sending the Develocity access key to a build-log-supplied URL. Because the destination host is attacker-chosen, the rule key on the credential-bearing request shape rather than on a fixed host; operationalize by alerting when such a request's destination is not on the approved Develocity host allowlist.

Elastic Detection

network where process.name == "java" and
  destination.port in (80, 443, 8080) and
  not destination.domain in ("develocity.example.internal", "gradle-enterprise.example.internal")

EQL over network events emitted by the Jenkins controller host. For best results, join with process events to confirm the Jenkins JVM as the source and alert on first-seen external destinations. Enrich with DNS events to catch resolution of attacker infrastructure preceding the outbound connection.

Splunk SPL Query

index=network sourcetype=zeek:conn OR sourcetype=pan:traffic
| search (dest_port=443 OR dest_port=80 OR dest_port=8080)
| eval is_jenkins=if(match(src_ip,"<JENKINS_CONTROLLER_IP_REGEX>"),1,0)
| where is_jenkins=1
| eval is_expected_develocity=if(match(dest_host,"(?i)develocity|gradle"),1,0)
| where is_expected_develocity=0
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_host dest_port
| where count > 3
| sort - count

Replace <JENKINS_CONTROLLER_IP_REGEX> with the CIDR/IP set of the controller. The query surfaces anomalous egress from the Jenkins controller to hosts that do not match the approved Develocity naming pattern.

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92132,">
  <rule id="2026921" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">java</field>
    <field name="destination.port">443|80|8080</field>
    <description>CVE-2026-92132: Jenkins controller outbound connection to non-approved host (possible Develocity access key capture)</description>
    <mitre>
      <id>T1552.001</id>
      <id>T1071</id>
    </mitre>
  </rule>

  <rule id="2026922" level="12">
    <if_sid>2026921</if_sid>
    <field name="destination.domain">^(?!.*(develocity|gradle-enterprise)).*$</field>
    <description>CVE-2026-92132: Jenkins Gradle Plugin request to attacker-specified URL — credential exfiltration suspected</description>
  </rule>
</group>

Ingest controller network/process telemetry (via Sysmon for Linux/Windows or auditd decoders) and tune the domain allowlist to match the configured Develocity server. Rule 2026922 escalates when the destination is outside the approved naming pattern.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch reference, or affected-version metadata was supplied by any tracked source at the time of writing. The guidance below is compensating-control oriented and must be revisited as soon as Jenkins publishes an advisory or a fixed Gradle Plugin version.

1. Immediate mitigations.

   • Restrict who can influence build logs and Gradle build logic on the Jenkins controller; treat build-log content as untrusted input when triaging incidents (the flaw exists precisely because this input was trusted).
   • Apply egress filtering on the Jenkins controller: allow outbound traffic only to the configured Develocity server, source control, and artifact repositories. A default-deny egress policy on the controller directly breaks the attacker's ability to receive the request at a chosen URL.
   • If the Gradle Plugin and Develocity integration are not required, disable or remove the plugin to eliminate the attack surface.
   • Rotate the Develocity access key in the Jenkins global configuration as a precaution if the instance ran with the affected plugin and users could modify build logs — rotation is the only certain way to invalidate a key that may already have been captured silently.

2. Patch / upgrade steps.

   • Track the Jenkins security advisories page and the Gradle Plugin plugin page for a fixed release. Because no patch version is currently identified by any tracked source, there is no version to upgrade to at this time. When a fix ships, upgrade the Gradle Plugin to the fixed version, restart the controller, and re-validate Develocity access-key handling in the global configuration.

3. Long-term hardening.

   • Introduce a controller egress allowlist as standing policy for all CI controllers, not just this one.
   • Grant the Develocity access key the minimum entitlements required (least privilege), so a captured key has bounded blast radius.
   • Add continuous network baselining for controller egress (the Suricata/Elastic/Splunk detections above) so anomalous outbound requests are alerted regardless of which log-supplied value triggers them.
   • Treat all build-log and build-script content as untrusted control data in plugin and pipeline design reviews; never let untrusted values select the destination of a credentialed request.

References

1. NVD — CVE-2026-92132: https://nvd.nist.gov/vuln/detail/CVE-2026-92132
2. Jenkins Security Advisories (monitor for the Gradle Plugin advisory and fixed version): https://www.jenkins.io/security/advisories/
3. Jenkins Gradle Plugin (release history and fix tracking): https://plugins.jenkins.io/gradle/
4. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): https://cwe.mitre.org/data/definitions/74.html
5. MITRE ATT&CK — T1552.001 Unsecured Credentials: Credentials In Files: https://attack.mitre.org/techniques/T1552/001/

Threat actor and exploit-in-the-wild status: CISA KEV: NO. No public proof-of-concept, no exploit code, and no Nuclei template were identified in the provided data. No known threat actor campaign has been attributed to this CVE. Collection quality is limited — the CNA title, affected-version list, OSV packages, vendor fix, and workarounds fields were empty — so this report deliberately avoids asserting implementation specifics that are not stated in the advisory. Re-validate against the Jenkins advisory once published.