CVE-2026-92134

Executive Summary

CVE-2026-92134 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Warnings Plugin (version 13.10258.va_17d49a_78c3b_ and earlier). An authenticated attacker with Item/Configure permission can submit a job configuration through the Jenkins REST API that supplies a javascript: scheme URL as the analysis results identifier, which is then stored and later executed in the context of a victim's browser session. Successful exploitation enables session hijacking, credential theft, and full compromise of Jenkins administrative functionality for any user who views the affected job configuration or build results.

Technical Analysis

The Jenkins Warnings Plugin aggregates static analysis results and associates them with a user-supplied identifier. According to the NVD description, the plugin "does not validate the analysis results ID when a job configuration is submitted through the REST API." This lack of input validation is the root cause of the vulnerability.

The attack surface is the Jenkins REST API endpoint responsible for accepting job configuration submissions. Because the identifier is persisted as part of the job configuration (it is "stored"), the malicious value survives server restarts and is rendered to any user who later views the relevant UI page. The plugin fails to enforce that the identifier conforms to a safe URL scheme; consequently, a value beginning with javascript: is accepted and subsequently emitted into an HTML attribute or link context without proper encoding or scheme allow-listing.

This is the classic stored XSS pattern mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw is authorization-gated: the attacker must possess Item/Configure permission, meaning a low-privileged but authenticated Jenkins user is sufficient. No public proof-of-concept or exploit code is currently available, and the attack chain below is inferred from the vulnerability class and the exact behavior described by the CNA.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker identifies a Jenkins instance where the Warnings Plugin is installed and where they hold a user account with Item/Configure permission on at least one job. Jenkins instances are commonly fingerprinted via the X-Jenkins response header and the distinctive Jenkins favicon.

2. Triggering the flaw class. The attacker submits a job configuration through the Jenkins REST API, setting the analysis results identifier field to a value that uses the javascript: URL scheme. The plugin does not validate this identifier, so the value is accepted and stored. This step requires only authenticated access with Item/Configure — no administrative privileges are needed.

3. Payload delivery (vulnerability-class level). Because the identifier is stored and later rendered in the Jenkins web UI, any user who views the affected job or its associated warnings/analysis results will have the malicious javascript: value executed in the context of their authenticated Jenkins session. The specific JavaScript payload is not documented in the available data.

4. Post-exploitation impact. Successful execution occurs under the victim's session privileges. Given the CVSS vector (C:H/I:H/A:H), the attacker can exfiltrate session cookies and CSRF tokens, perform actions as the victim, and potentially escalate to administrative control of Jenkins, including modification of jobs, credentials, and build pipelines.

Note: No public PoC is available; the above chain is inferred strictly from the NVD description and the stored-XSS vulnerability class. No specific endpoint paths, parameter names, or code identifiers beyond those in the description have been asserted.

Impact Assessment

The CVSS 3.1 base score is 8.0 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Broken down: the attack is network-reachable (AV:N), requires low complexity (AC:L), needs low privileges (PR:L — Item/Configure), and requires user interaction (UI:R — a victim must view the crafted page). Confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H) with an unchanged scope (S:U).

Business impact is significant because Jenkins is a central CI/CD control plane. Compromise of an authenticated session can lead to unauthorized pipeline modification, injection of malicious build steps, theft of deployment credentials, and lateral movement into connected environments. The blast radius spans any project using the affected plugin and any user who interacts with the poisoned job configuration, particularly administrators whose sessions carry the highest privilege.

Detection Guidance

Sigma Rule

title: Jenkins Warnings Plugin Stored XSS via javascript: Identifier
id: 8f2c1a44-9213-4c7b-9d10-3a6e5f0b7c21
status: experimental
description: Detects submission of a javascript: scheme URL as the analysis results identifier in Jenkins job configuration via REST API
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92134
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: jenkins
detection:
  selection_method:
    cs-method:
      - 'POST'
  selection_uri:
    cs-uri-query|contains: 'configSubmit'
  selection_payload:
    cs-uri-query|contains: 'javascript:'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-username
  - cs-uri-query
falsepositives:
  - Legitimate documentation referencing javascript: strings in job descriptions
level: high

YARA Rule

rule CVE_2026_92134_Jenkins_Warnings_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects javascript: scheme identifiers stored by Jenkins Warnings Plugin (CVE-2026-92134)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92134"
        date = "2026-01-01"
        severity = "high"
    strings:
        $js = "javascript:" ascii wide nocase
        $plugin = "warnings-ng" ascii wide nocase
        $plugin2 = "Warnings" ascii wide
    condition:
        $js and any of ($plugin*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92134 Jenkins Warnings Plugin Stored XSS Attempt (javascript: identifier)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"configSubmit"; http.uri; content:"javascript%3A"; nocase; reference:cve,2026-92134; classtype:web-application-attack; sid:202692134; rev:1;)

Elastic Detection

any where process.name == "java"
  and network.direction == "inbound"
  and http.request.method == "POST"
  and http.request.body.content : "javascript:"
  and url.path : "*configSubmit*"

Splunk SPL Query

index=web sourcetype=jenkins_access
| search http_method=POST uri_path="*/configSubmit*" uri_query="*javascript*"
| table _time src_ip user uri_path uri_query status
| sort - _time

Wazuh OSSEC Rule

<group name="web,jenkins,cve-2026-92134">
  <rule id="100921" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>configSubmit</url>
    <match>javascript</match>
    <description>CVE-2026-92134: Jenkins Warnings Plugin stored XSS attempt via javascript: identifier</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict Item/Configure permission to the smallest possible set of trusted users.
   • Disable or restrict REST API access to job configuration endpoints where feasible.
   • Front Jenkins with a WAF/proxy rule rejecting parameters containing javascript: scheme values.
   • Monitor Jenkins access logs for javascript: payloads in configuration submissions (see detection rules above).

2. Patch/upgrade steps.

   • No fixed version is currently identified by any tracked source. Monitor the Jenkins security advisories page and the Warnings Plugin changelog for an updated release. As of this writing there is no vendor fix; treat as unpatched.

3. Long-term hardening.

   • Enforce Content Security Policy (CSP) headers to block inline javascript: URL execution.
   • Apply the principle of least privilege across Jenkins roles; avoid granting Item/Configure broadly.
   • Enable script approval and audit logging; regularly review plugin inventory and remove unused plugins.

References

• NVD — CVE-2026-92134: https://nvd.nist.gov/vuln/detail/CVE-2026-92134
• Jenkins Security Advisories: https://www.jenkins.io/security/advisories/
• Jenkins Warnings Plugin: https://plugins.jenkins.io/warnings-ng/
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — JavaScript: https://attack.mitre.org/techniques/T1059/007/

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-92134. CISA KEV status: NO. EPSS: not yet scored by FIRST.org.