Read the docs
TI-2026-41220 Aliases CVE-2026-57283GHSA-72c8-3wwg-r59w

Cross-site request forgery in Jenkins Pipeline: Groovy Plugin

Priority LOW 20CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Partial io.jenkins.plugins:pipeline-groovy-lib (Maven): 4331.4333Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Pipeline: Groovy Pluginup to 4331.v9d06ed4658ff—No fix listedCNA
—io.jenkins.plugins:pipeline-groovy-lib (Maven)before 4331.43334331.4333Patch availableGHSA-72c8-3wwg-r59w
  • Jenkins Pipeline: Groovy Plugin VendorJenkins Affected up to 4331.v9d06ed4658ff Fixed in — No fix listed CNA
  • io.jenkins.plugins:pipeline-groovy-lib (Maven) Vendor— Affected before 4331.4333 Fixed in 4331.4333 Patch available GHSA-72c8-3wwg-r59w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:*_groovyVulnerableJenkins
  • cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:* Versions _groovy Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-72c8-3wwg-r59w io.jenkins.plugins:pipeline-groovy-lib (Maven) Fixed in 4331.4333 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Jenkins Pipeline: Groovy Plugin — Jenkins Security Advisory 2026-06-24

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-41221 Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the…Priority LOW 20
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57283
  2. 2026-10-03 Alias added: GHSA-72c8-3wwg-r59w

References

Advisory 2

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15846 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… CVSS 3.1HIGH 8.8
  • TI-2019-15847 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier… CVSS 3.1HIGH 8.8
  • TI-2023-11034 Cross-site scripting in Jenkins Pipeline: Build Step Plugin CVSS 3.1MEDIUM 5.4
  • TI-2019-15886 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-21197 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin CVSS 3.1CRITICAL 9.9
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences