All vulnerabilities
CVE-2026-57284GHSA-2w2h-gwwj-fh3q

io.jenkins.plugins:pipeline-groovy-lib: Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

Jenkins Project io.jenkins.plugins:pipeline-groovy-libmavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4331.4333Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 4331.4333io.jenkins.plugins:pipeline-groovy-lib, mavenGitHub<dependency><groupId>io.jenkins.plugins</groupId><artifactId>pipeline-groovy-lib</artifactId><version>4331.4333</version></dependency>
  • 4331.4333io.jenkins.plugins:pipeline-groovy-lib, MavenOSV<dependency><groupId>io.jenkins.plugins</groupId><artifactId>pipeline-groovy-lib</artifactId><version>4331.4333</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request.

This allows attackers to have Pipeline: Groovy Plugin instantiate types related to job or system configuration other than Pipeline steps.

Additionally, this HTTP endpoint can be accessed using the GET method and does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. This allows attackers to create a script approval request attributed to another user, impersonating a trusted user when social engineering an administrator into approving a malicious script.

This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Pipeline: Groovy Plugin 4331.4333.v50a_b_076c5199 only instantiates Pipeline steps and metastep delegates through the Snippet Generator, and requires POST requests for the affected HTTP endpoint.

Text from GitHub Advisory Database

Affected versions 38

  • io.jenkins.plugins:pipeline-groovy-lib, maven< 4331.4333GitHub
  • Jenkins Pipeline: Groovy Pluginaffected: all versions through 4331.v9d06ed4658ffCVE List
  • io.jenkins.plugins:pipeline-groovy-lib, Mavenfrom first release, fixed in 4331.4333OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven589.vb_a_b_4a_a_8c443cOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven591.v3a_7f422b_d058OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven593.595.vfc6485d13dcdOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven593.va_a_fc25d520e9OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven598.vcd66b_a_336510OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven612.614.v48dcb_f62a_640OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven612.v84da_9c54906dOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven613.v9c41a_160233fOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven621.vb_44ce045b_582OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven629.vb_5627b_ee2104OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven656.va_a_ceeb_6ffb_f7OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven671.v07c339c842e8OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven673.vb_c5d5948283cOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven685.v8ee9ed91d574OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven687.v62591d623759OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven689.veec561a_dee13OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven700.v0e341fa_57d53OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven704.vc58b_8890a_384OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven710.v4b_94b_077a_808OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven727.ve832a_9244dfa_OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven730.ve57b_34648c63OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven740.va_2701257fe8dOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven744.v5b_556ee7c253OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven745.vdf6077913de0OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven749.v70084559234a_OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven751.v709f84f7d768OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven752.vdddedf804e72OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven763.v13008816b_de7OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven766.v2b_e08c2e6ff2OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven776.vfee5327b_b_a_5b_OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven787.ve2fef0efdca_6OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven797.v90ea_a_9b_e45a_0OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven798.v5cc688825312OSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven805.va_fc79344957dOSV
  • io.jenkins.plugins:pipeline-groovy-lib, Maven806.v408277b_33d1dOSV

References 5