Jenkins Fixes 20 Plugin Flaws Allowing Sandbox Escapes and RCE

Jenkins fixed 20 vulnerabilities in plugins in an advisory issued on 16 September 2026. The issues comprise 11 high-severity, seven medium-severity, one low-severity and one unrated flaw. No active exploitation or public proof-of-concept had been confirmed. The highest-rated vulnerabilities, including CVE-2026-92122, CVE-2026-92123, CVE-2026-92124, CVE-2026-92125 and CVE-2026-92137, have CVSS v3 scores of 8.8.

Seven flaws affect the Script Security Plugin and allow users able to define and run sandboxed Pipelines to escape the Groovy sandbox and execute arbitrary code in the Jenkins controller JVM. The article says the weaknesses involve techniques including interface coercion, null receivers, collection casting and compile-time Groovy annotations such as `@GroovyASTTransformationClass` and `@Builder`. Related issues affect classpath approval and a time-of-check-to-time-of-use race condition.

Other problems include path traversal in the Robot Framework Plugin, which can lead to remote code execution, stored cross-site scripting in plugins including Warnings, Coverage and Dependency-Check, and server-side request forgery in the Gradle and Bitbucket plugins that could expose stored credentials.

The vulnerabilities affect plugins rather than Jenkins core. Reported examples include Script Security versions up to 1415.v9a_f9b_3a_c253d and Robot Framework versions up to 6.2.2. Jenkins users should update affected plugins: Script Security to 1422.v06869826dd9b_ or later, Robot Framework to 6.3.0, and other plugins to their specified fixed versions. The project also recommends restricting who can configure jobs and define Pipeline scripts.