Developer platforms, tools and supply chain

Jenkins plugin security advisory of 16 September 2026 (CVE-2026-92122 to CVE-2026-92141)

Jenkins plugin check

Jenkins published a security advisory on 16 September 2026 covering 20 vulnerabilities in 13 widely deployed plugins. Eight are High-severity flaws in Script Security, the plugin that sandboxes Groovy for Pipelines and is installed on nearly every Jenkins server. They are ways around the sandbox that let a user who may define Pipeline scripts run code in the controller's JVM. The techniques include interface coercion, calls on a null receiver, collection casts, AST transformations, @Builder at compile time, dynamic methods, a classpath approval bypass, and a time-of-check to time-of-use race on approved remote JARs.

The eight Script Security identifiers are CVE-2026-92122, CVE-2026-92123, CVE-2026-92124, CVE-2026-92125, CVE-2026-92126, CVE-2026-92127, CVE-2026-92128 and CVE-2026-92129. No exploitation was reported in the sources used.

How the script reads an install

A plugin's version is the Plugin-Version line of its META-INF/MANIFEST.MF, either in the expanded plugin directory or inside the .jpi or .hpi file under $JENKINS_HOME/plugins. A manifest wraps long lines, and a line that starts with one space continues the line before. The script joins them and handles Windows line endings. The 13 short names were checked against each plugin's own project file.

Versions are compared by their leading dotted number, as numbers (so 5.6.10 is newer than 5.6.5). Two builds with the same number but different build hashes cannot be ordered, and are reported as such. A plugin that is disabled does not run and is reported as such: update or remove it anyway. A listed plugin that is installed but whose version cannot be read (a manifest with no Plugin-Version, or no manifest) is never skipped: it is reported as a warning, exit 1, with the fixed version to confirm in the Plugin Manager.

Quick start

curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/jenkins/jenkins-check.sh
less jenkins-check.sh
chmod +x jenkins-check.sh
./jenkins-check.sh check

It looks in $JENKINS_HOME, /var/lib/jenkins and /var/jenkins_home. Pass one or more Jenkins home directories to name them. Everything is read-only.

Commands

Update

Update the plugins in Manage Jenkins, Plugins, then restart Jenkins. Until you can, the project suggests limiting who holds Pipeline authoring and Item/Configure permissions; that is not Jenkins guidance.

After an update

If an affected Script Security, GitLab, Gradle or Bitbucket plugin was installed while users you do not fully trust could define Pipelines or edit jobs, treat the credentials those plugins could reach as possibly exposed and rotate them. That means GitLab, Bitbucket, Develocity and OAuth credentials, and Jenkins credentials.

Sources

• Jenkins security advisory, 2026-09-16
• Cyber Security News: Jenkins fixes 20 plugin vulnerabilities

Before you run it

• The fix. Update the listed plugins in Manage Jenkins, Plugins, then restart Jenkins.
• It reads manifests, not the update center. Each plugin's Plugin-Version is read from its expanded directory first, then its .jpi or .hpi archive. A plugin that is installed but whose version cannot be read is reported, not skipped, and a plugin that is disabled is noted as not running (update or remove it anyway). Two builds with the same leading number but different hashes cannot be ordered, and are reported that way.
• It also reads running containers. With SCAN_CONTAINERS=1 (the default) it reads the advisory plugins' manifests inside running docker and podman containers (JENKINS_HOME there, default /var/jenkins_home), judged by the same rules. It is skipped when you name the home directories yourself.
• The protective measure is the project's, not Jenkins's. Limiting who holds Pipeline authoring and Item/Configure permissions reduces the exposure to the High flaws. There is no hunt.

Red Hat advisories

Red Hat's advisory list (security advisories released 2026-04-01 to 2026-11-03) names the CVEs below. A Red Hat build is judged by its RPM release, not by the upstream version number, because Red Hat backports fixes: the advisory names the release that fixes it. A CVE with no advisory in the list has none for that period, which is not the same as not affected. The current state is on Red Hat's CVE database.

These are the OpenShift Jenkins images, not the RHEL packages.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg