CVE-2026-92123
Quick assessment
Affected
Jenkins Project Jenkins Script Security Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jenkins Script Security 插件 1415.v9af9b3ac253d 及更早版本未对作用于空接收者的操作（包括方法调用、属性和属性访问、以及数组访问）进行拦截。这使得拥有定义和运行沙箱脚本（包括 Pipeline）权限的攻击者能够绕过沙箱保护机制，并在 Jenkins 控制器 JVM 的上下文中执行任意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | ≤ 1415.v9a_f9b_3a_c253d |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92123
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | 0 ~ 1415.v9a_f9b_3a_c253d | - |
|
II. Public POCs for CVE-2026-92123
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92123
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92123 (1)
Same Patch Batch · Jenkins Project · 2026-09-16 · 20 CVEs total
| CVE-2026-92131 | Groovy Libraries 805.va_fc79344957d 路径遍历漏洞 | |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9af9b3ac253d及以下版本沙箱逃逸漏洞 | |
| CVE-2026-92124 | Jenkins脚本安全插件1415.v9af9b3ac253d前存在沙箱逃逸漏洞 | |
| CVE-2026-92125 | Jenkins Script Security插件沙箱逃逸漏洞 | |
| CVE-2026-92127 | Jenkins脚本安全插件1415及之前版本远程代码执行 | |
| CVE-2026-92126 | Jenkins Script Security插件沙箱绕过漏洞 | |
| CVE-2026-92128 | Jenkins Script Security插件1415.09af9b3ac253d及更早版本远程代码执行 | |
| CVE-2026-92130 | Jenkins Pipeline插件凭证泄露漏洞 | |
| CVE-2026-92129 | Jenkins插件1415版沙箱绕过漏洞 | |
| CVE-2026-92132 | Jenkins Gradle Plugin低版本Develocity访问密钥泄露 | |
| CVE-2026-92141 | Jenkins Keycloak插件2.4.1重定向钓鱼漏洞 | |
| CVE-2026-92133 | Jenkins GitLab Plugin 1.2149及之前版本凭证缓存访问漏洞 | |
| CVE-2026-92134 | Jenkins Warnings 13.10258版存储型XSS漏洞 | |
| CVE-2026-92135 | Jenkins Coverage插件≤3.3358存储型XSS漏洞 | |
| CVE-2026-92136 | Jenkins 5.6.4 前未转义CWE致存储型XSS漏洞 | |
| CVE-2026-92137 | Jenkins Robot Framework 6.2.2前路径校验缺失致RCE | |
| CVE-2026-92138 | Jenkins Bitbucket插件≤6.0.1 OAuth令牌劫持 | |
| CVE-2026-92140 | Jenkins Gitee插件存储型XSS漏洞 | |
| CVE-2026-92139 | Jenkins Bitbucket插件4.0.1前凭证泄露 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-92123
No comments yet