Read the docs
TI-2026-41221 Aliases CVE-2026-57284GHSA-2w2h-gwwj-fh3q

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the…

Priority LOW 20CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed io.jenkins.plugins:pipeline-groovy-lib (Maven): 4331.4333

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Pipeline: Groovy Pluginup to 4331.v9d06ed4658ff—No fix listedCNA
—io.jenkins.plugins:pipeline-groovy-lib (Maven)before 4331.43334331.4333Patch availableGHSA-2w2h-gwwj-fh3q
  • Jenkins Pipeline: Groovy Plugin VendorJenkins Affected up to 4331.v9d06ed4658ff Fixed in — No fix listed CNA
  • io.jenkins.plugins:pipeline-groovy-lib (Maven) Vendor— Affected before 4331.4333 Fixed in 4331.4333 Patch available GHSA-2w2h-gwwj-fh3q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:*_groovyVulnerableJenkins
  • cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:* Versions _groovy Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-2w2h-gwwj-fh3q io.jenkins.plugins:pipeline-groovy-lib (Maven) Fixed in 4331.4333 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Jenkins Pipeline: Groovy Plugin — Jenkins Security Advisory 2026-06-24

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-41220 Cross-site request forgery in Jenkins Pipeline: Groovy PluginPriority LOW 20
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57284
  2. 2026-10-03 Alias added: GHSA-2w2h-gwwj-fh3q

References

Advisory 2

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15846 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… CVSS 3.1HIGH 8.8
  • TI-2019-15847 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier… CVSS 3.1HIGH 8.8
  • TI-2023-11034 Cross-site scripting in Jenkins Pipeline: Build Step Plugin CVSS 3.1MEDIUM 5.4
  • TI-2019-15886 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-21197 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin CVSS 3.1CRITICAL 9.9
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences