Jenkins discloses five Groovy sandbox escape routes

Jenkins published five Script Security Plugin advisories on 16 September 2026, each describing a separate path from a sandboxed Pipeline script to arbitrary code execution in the controller JVM. The flaws CVE-2026-92122, 92123, 92124, 92125 and 92129 are rated 8.8 and 7.5 and affect versions 1415.v9a_f9b_3a_c253d and earlier.

• Five CVEs rated 8.8 and 7.5 affect Script Security Plugin up to 1415.v9a_f9b_3a_c253d
• Four are interception gaps: proxies, null receivers, collection casts and runtime-added methods
• The fifth is @GroovyASTTransformationClass, which runs code at compile time
• Exploitation requires only permission to define and run Pipeline scripts