Executive brief
The Jenkins Pipeline: Groovy Libraries Plugin, which allows developers to share code across different automation pipelines, contains a security flaw. An attacker who can modify the code within a shared library can use symbolic links to trick the system into reading sensitive files from the Jenkins server's filesystem. This could lead to the exposure of configuration data, credentials, or other private information stored on the server.
Technical details
The Jenkins Pipeline: Groovy Libraries Plugin (versions 797.v90ea_a_9b_e45a_0 and earlier) fails to prohibit or validate symbolic links within shared libraries. This is a 'Link Following' vulnerability (CWE-59). An attacker with the ability to control the content of a library used by a Pipeline job (requiring Low privileges and High attack complexity due to the need for library control) can create a symbolic link pointing to sensitive files on the Jenkins controller's filesystem. When the Pipeline job processes the library, it follows the link, allowing the attacker to read arbitrary files. The issue is resolved in version 798.v5cc688825312.
Affected products
- Jenkins Project Pipeline: Groovy Libraries Plugin <= 797.v90ea_a_9b_e45a_0
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched