CVE-2026-92136

Summary

The flaw allows attackers with Item/Configure permission to inject malicious scripts into Jenkins UI, leading to potential data theft and manipulation.

Exploitability

Exploitation is moderately hard as it requires attackers to have Item/Configure permission, but once achieved, the vulnerability can be easily triggered.

Blast radius

If exploited, the vulnerability could result in unauthorized access to sensitive information and control over Jenkins configurations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Jenkins OWASP Dependency-Check Plugin 5.6.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.