CVE-2026-92127
Quick assessment
Affected
Jenkins Project Jenkins Script Security Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jenkins Script Security 插件 1415.v9a_f9b_3a_c253d 及更早版本存在安全漏洞：当拥有“Overall/Administer”权限的用户复制某个配置项（item），或通过 REST API 或 CLI 更新该配置时，该插件会自动批准其中的类路径（classpath）条目。这使得能够定义类路径条目的攻击者可以在 Jenkins 控制节点（controller）JVM 上下文中执行任意代码。
Possible ATT&CK Techniques 1 AI
T1059.006 · PythonAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | ≤ 1415.v9a_f9b_3a_c253d |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | 0 ~ 1415.v9a_f9b_3a_c253d | - |
|
II. Public POCs for CVE-2026-92127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92127
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92127 (1)
Same Patch Batch · Jenkins Project · 2026-09-16 · 20 CVEs total
| CVE-2026-92131 | Groovy Libraries 805.va_fc79344957d 路径遍历漏洞 | |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9af9b3ac253d及以下版本沙箱逃逸漏洞 | |
| CVE-2026-92124 | Jenkins脚本安全插件1415.v9af9b3ac253d前存在沙箱逃逸漏洞 | |
| CVE-2026-92123 | Jenkins Script Security Plugin 低版本空值接收者沙箱绕过 | |
| CVE-2026-92125 | Jenkins Script Security插件沙箱逃逸漏洞 | |
| CVE-2026-92126 | Jenkins Script Security插件沙箱绕过漏洞 | |
| CVE-2026-92128 | Jenkins Script Security插件1415.09af9b3ac253d及更早版本远程代码执行 | |
| CVE-2026-92130 | Jenkins Pipeline插件凭证泄露漏洞 | |
| CVE-2026-92129 | Jenkins插件1415版沙箱绕过漏洞 | |
| CVE-2026-92132 | Jenkins Gradle Plugin低版本Develocity访问密钥泄露 | |
| CVE-2026-92141 | Jenkins Keycloak插件2.4.1重定向钓鱼漏洞 | |
| CVE-2026-92133 | Jenkins GitLab Plugin 1.2149及之前版本凭证缓存访问漏洞 | |
| CVE-2026-92134 | Jenkins Warnings 13.10258版存储型XSS漏洞 | |
| CVE-2026-92135 | Jenkins Coverage插件≤3.3358存储型XSS漏洞 | |
| CVE-2026-92136 | Jenkins 5.6.4 前未转义CWE致存储型XSS漏洞 | |
| CVE-2026-92137 | Jenkins Robot Framework 6.2.2前路径校验缺失致RCE | |
| CVE-2026-92138 | Jenkins Bitbucket插件≤6.0.1 OAuth令牌劫持 | |
| CVE-2026-92140 | Jenkins Gitee插件存储型XSS漏洞 | |
| CVE-2026-92139 | Jenkins Bitbucket插件4.0.1前凭证泄露 |
IV. Related Vulnerabilities
Same product: Jenkins Script Security Plugin
V. Comments for CVE-2026-92127
No comments yet