Jenkins Script Security CVE-2026-92122

Exploitation requires an authenticated principal holding permission to define and run sandboxed scripts, including Jenkins Pipelines (typically Job/Configure or Pipeline-authoring rights) - the CVSS PR:L reflects this. The attacker must craft a script that coerces a value to a Java interface where the coerced value inherits a method of the same name as an interface method; the proxy generated by Script Security fails to check that inherited method, which is the exact trigger. Limiting factors: the sandbox-script permission gate means anonymous or read-only users cannot exploit this, SSVC rates it non-automatable (no mass exploitation), and no user interaction is needed once the malicious script runs. Any Jenkins controller running Script Security Plugin ≤ 1415.v9a_f9b_3a_c253d with sandboxed scripting delegated to non-admin users is exposed by default configuration.

This is a genuine RCE-class sandbox escape but its real-world priority is tempered by a hard authorization prerequisite. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) reflects network reach, low complexity, and total technical impact once triggered - consistent with the SSVC 'Technical Impact: total' rating. However, three independent low-signal indicators argue against treating this as an emergency: SSVC 'Exploitation: none' (no observed exploitation), SSVC 'Automatable: no' (cannot be sprayed at scale without a valid Jenkins account and script-authoring rights), and the absence of any CISA KEV listing, public POC, or EPSS score at time of analysis. The PR:L in the vector is the decisive limiter - this is exploitable only by a principal who already holds permission to define and run sandboxed Pipelines/scripts, i.e. a semi-trusted insider or a compromised low-privilege developer account, not an anonymous internet attacker. One notable ambiguity: the vendor scored Scope Unchanged (S:U) even though the attack escapes a security-authority boundary (the Groovy sandbox) to execute in the controller JVM security context; a Scope Changed (S:C) reading is defensible and would raise the score. Net: a legitimate high-severity issue that Jenkins operators should patch promptly, but not a drop-everything internet-facing emergency - closer to privilege-escalation-for-insiders than mass-exploitable RCE.

A developer or CI user who has been granted rights to author Jenkins Pipelines (a common delegation in shared CI environments) writes a sandboxed script that coerces an attacker-controlled value to a Java interface where the value inherits a method whose name collides with an interface method. Because the generated proxy fails to check that inherited method, the call escapes the Groovy sandbox and runs arbitrary code in the Jenkins controller JVM, granting full control of the controller and its credentials. No public exploit code or active exploitation has been identified at time of analysis.