CVE-2026-92135

Executive Summary

CVE-2026-92135 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Coverage Plugin (version 3.3358.v9487dde48783 and earlier). The plugin fails to validate the coverage results ID when a job configuration is submitted through the Jenkins REST API, allowing an authenticated attacker holding Item/Configure permission to inject a javascript: scheme URL that is stored and later rendered in a victim's browser session. Successful exploitation enables session hijacking, credential theft, and arbitrary actions performed in the context of the victim's Jenkins session, which given the CVSS base score of 8.0 constitutes a high-severity risk to any Jenkins controller exposing the Coverage Plugin to users with configuration rights.

Technical Analysis

The vulnerability resides in the REST API path used to submit job configuration for the Jenkins Coverage Plugin. The core defect is the absence of validation on the "coverage results ID" — the identifier supplied when a job configuration referencing coverage results is submitted. Because the identifier is accepted without scheme or content validation, an attacker can supply a value beginning with the javascript: URI scheme. That value is persisted as part of the job configuration (stored XSS), and when the coverage results view is subsequently rendered in a user's browser, the javascript: payload executes in the origin of the Jenkins controller.

The relevant CWE classification is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent subtype. The attack surface is the Jenkins REST API endpoint used for job configuration submission; the flaw is reachable by any principal with Item/Configure permission. This permission requirement is significant: it means the attacker must already be authenticated to Jenkins and hold a leg up on the target job. Combined with Low attack complexity, the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack requiring low privileges and user interaction, with high confidentiality, integrity, and availability impact within the vulnerable component's security scope.

Two aspects deserve emphasis. First, this is a stored XSS, not reflected: the malicious javascript: identifier becomes part of persistent job configuration, so the payload remains dormant until a victim views the affected coverage results — no live attacker interaction is needed at trigger time. This separates it from ephemeral reflected XSS and increases the dwell time and reach of the attack. Second, because the injection point is a REST API configuration field, exploitation does not require the attacker to manipulate the Jenkins UI at all; a direct API call with the crafted payload is sufficient, meaning that API tokens or scripted access are the natural delivery vector.

The NVD description does not enumerate the specific API endpoint, parameter name, or rendering template at which validation is missing. Per the accuracy constraints of this report, no fabricated function names, endpoints, or parameter names are provided; the analysis is deliberately confined to the vulnerability class (stored XSS via unvalidated URI-scheme identifier in a REST API configuration field). No public proof-of-concept, Nuclei template, or exploit code was identified in the provided intelligence.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored XSS via unvalidated identifier) and the exact details disclosed in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Jenkins controller with the Coverage Plugin 3.3358.v9487dde48783 or earlier installed. Exposure of the Jenkins web UI and REST API to the attacker's network location is required (AV:N). The attacker must hold a valid account with Item/Configure permission (PR:L), which in many CI environments is granted broadly to developers and build engineers rather than restricted to administrators.

2. Triggering the flaw. Using the Jenkins REST API, the attacker submits a job configuration (for a job within the scope of their Item/Configure permission) in which the coverage results identifier is set to a value using the javascript: scheme. Because the plugin does not validate this identifier, the malicious value is accepted and persisted into the job's stored configuration.

3. Payload execution. When a user with access to the affected job or coverage results opens the corresponding view, the stored javascript: identifier is rendered in that user's browser and executes in the security origin of the Jenkins controller (UI:R — a victim must view the affected content). The payload can, at the vulnerability-class level, read/modify content in the Jenkins UI, issue authenticated requests on behalf of the victim, and exfiltrate data visible to the victim's session.

4. Post-exploitation impact. Success yields high confidentiality and integrity impact: session hijacking or CSRF-style actions as the victim, theft of secrets visible to the victim (including, in many Jenkins deployments, credentials and build configuration reachable through the authenticated UI), and the potential for lateral movement into build pipelines and connected systems. The high availability subscore reflects the potential to disrupt the vulnerable component through attacker-controlled actions in the victim's session. No exploit-in-the-wild evidence, KEV listing, or threat actor attribution was identified in the supplied intelligence.

Impact Assessment

The CVSS 3.1 base score is 8.0 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Interpretation of each metric:

• AV:N (Network): The Jenkins REST API is remotely reachable; no local or adjacent access is required.
• AC:L (Low): No specialized conditions, race conditions, or unusual configuration are required once the plugin is installed and the attacker has the necessary permission.
• PR:L (Low): The attacker needs Item/Configure permission, a low-privilege but authenticated role relative to Jenkins administration.
• UI:R (Required): A victim must load the view in which the stored payload is rendered.
• S:U (Unchanged): Impact is confined to the vulnerable component's security authority.
• C:H/I:H/A:H: High confidentiality, integrity, and availability impact within the Jenkins controller context.

The blast radius is any Jenkins controller with the Coverage Plugin installed and reachable by users holding Item/Configure permission. Because Jenkins controllers frequently host credentials, deploy keys, and pipeline definitions, a single successful stored XSS can allow an attacker to pivot from a low-privilege job-configuration role into broader controller compromise. The stored nature of the payload means it can affect multiple victims over time, and it persists until the malicious configuration is identified and removed. EPSS is not yet scored by FIRST.org, so no probability estimate is available; CISA KEV does not list this CVE, and no public exploit code was identified.

Detection Guidance

Sigma Rule

Detects REST API submissions to Jenkins that include a javascript: scheme in the coverage results identifier field. Field and endpoint names should be adapted to the deployment's log schema once exact parameter names are confirmed; the rule keys on the javascript: scheme in configuration-submission activity.

title: Jenkins Coverage Plugin Stored XSS via javascript Scheme Identifier
id: 7c2f9b3e-1a44-4e8d-9c21-8f0e5b6a2d10
status: experimental
description: Detects job configuration submissions to the Jenkins REST API containing a javascript scheme value in a coverage results identifier, consistent with CVE-2026-92135.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92135
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
  product: jenkins
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-stem|contains:
      - '/configSubmit'
      - '/job/'
  selection_payload:
    cs-uri-query|contains: 'javascript:'
  condition: selection_method and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate documentation or comments containing the string "javascript:" in unrelated fields
level: high

YARA Rule

Scans Jenkins configuration artifacts and plugin data for the stored javascript: scheme in a coverage results identifier context. This is a heuristic, text-based rule targeting the persistence of the payload.

rule CVE_2026_92135_Jenkins_Coverage_Stored_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects stored javascript: scheme coverage results identifiers associated with CVE-2026-92135 in Jenkins Coverage Plugin configurations"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92135"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cov = "coverage" nocase ascii wide
        $js  = "javascript:" nocase ascii wide
        $cfg = "config" nocase ascii wide

    condition:
        filesize < 5MB and
        $js and
        ($cov and $cfg)
}

Suricata IDS Rule

Detects HTTP POST requests to the Jenkins REST API whose payload contains a javascript: scheme near coverage-related parameters. Tune the URI content match to the deployment's Jenkins paths.

alert http any any -> any any (msg:"CVE-2026-92135 Jenkins Coverage Plugin Stored XSS Attempt (javascript scheme in config submit)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"configSubmit"; nocase; http.request_body; content:"javascript:"; nocase; classtype:web-application-attack; reference:cve,2026-92135; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92135; sid:202692135; rev:1;)

Elastic Detection

EQL rule on HTTP or Jenkins access logs identifying API configuration submissions carrying a javascript: scheme value.

any where
  http.request.method == "POST" and
  stringContains(http.request.body, "javascript:") and
  (stringContains(url.path, "configSubmit") or stringContains(url.path, "/job/"))

Splunk SPL Query

Search web/access logs for configuration-submission requests containing the javascript: scheme.

index=web (sourcetype=access_combined OR sourcetype=jenkins)
| search method=POST
| search (uri_path="*configSubmit*" OR uri_path="*/job/*")
| search (uri_query="*javascript:*" OR form_data="*javascript:*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, user
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

Wazuh decoder/rule set matching web server access log lines for POSTs containing a javascript: scheme to Jenkins configuration endpoints.

<group name="web,jenkins,cve-2026-92135,">
  <rule id="100135" level="12">
    <if_sid>31100</if_sid>
    <field name="method">POST</field>
    <url>configSubmit</url>
    <description>CVE-2026-92135: Jenkins configuration submission containing javascript scheme (potential stored XSS)</description>
    <group>cve_2026_92135,attack.t1190,</group>
  </rule>
  <rule id="100136" level="12">
    <if_sid>31100</if_sid>
    <field name="method">POST</field>
    <match>javascript:</match>
    <description>CVE-2026-92135: POST request containing javascript: scheme to Jenkins (possible Coverage Plugin stored XSS)</description>
    <group>cve_2026_92135,attack.t1190,</group>
  </rule>
</group>

Note: The above detection content is rule-template grade; the exact URI and parameter names for the Coverage Plugin's configuration submission must be confirmed against the target Jenkins instance and the rules tuned accordingly, since the NVD description does not disclose them.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version, vendor advisory, workaround, or OSV package mapping was identified in the supplied intelligence. The recommendations below are standard mitigations for authenticated stored XSS in Jenkins plugins, not vendor-confirmed fixes.

1. Immediate mitigations

   • Restrict the Coverage Plugin: if not operationally required, disable or remove the Coverage Plugin from the Jenkins controller to eliminate the attack surface entirely.
   • Tighten Item/Configure permission: audit and restrict who holds Item/Configure on jobs. Since exploitation requires this permission, reducing its footprint directly reduces exposure.
   • Restrict Jenkins REST API and UI network exposure to trusted networks/VPN; do not expose the controller directly to the internet.
   • Enable Jenkins' Content Security Policy (CSP) configuration, which can block inline javascript: execution, and review its report-only/ enforcement posture.
   • Monitor and audit stored job configurations for javascript: scheme values in coverage-related identifiers.

2. Patch/upgrade steps

   • No fixed version is currently available per tracked sources. Monitor the Jenkins security advisories and the Coverage Plugin release notes for a version that validates the coverage results identifier.
   • When a fix is released, upgrade the plugin via the Jenkins Update Center or by deploying the corrected .hpi.
   • After upgrading, review and sanitize any existing job configurations that may contain attacker-introduced javascript: identifiers.

3. Long-term hardening

   • Maintain a plugin inventory and subscribe to Jenkins security advisories; apply plugin updates promptly.
   • Apply least privilege to Item/Configure and avoid granting it broadly across CI user populations.
   • Deploy CSP enforcement on the Jenkins controller to mitigate XSS classes broadly.
   • Log and alert on REST API configuration submissions that include script-scheme URIs, building detections from the provided rule templates.

References

• NVD — CVE-2026-92135: https://nvd.nist.gov/vuln/detail/CVE-2026-92135
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• Jenkins Security Advisories index (monitor for the Coverage Plugin fix): https://www.jenkins.io/security/advisories/
• Jenkins Coverage Plugin page (Update Center / plugin releases): https://plugins.jenkins.io/coverage/
• ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Threat actor campaigns / exploit-in-the-wild: None identified. CISA KEV does not list CVE-2026-92135, no public PoC, exploit code, or Nuclei template was found in the supplied intelligence, and EPSS has not yet scored this CVE.