CVE-2026-57283: Jenkins Pipeline Groovy Plugin CSRF in Snippet Generator

CVE-2026-57283 · Severity: medium · CVSS 4.3 · Published 2026-06-24

A vulnerability in the Jenkins Pipeline: Groovy Plugin allows attackers to trick authorized users into performing unintended actions via Cross-Site Request Forgery (CSRF). This specific flaw can be used to generate unauthorized script approval requests, potentially leading an administrator to unknowingly approve malicious code. The plugin is a core component used to define and run automated build workflows in Jenkins.

Technologies: io.jenkins.plugins:pipeline-groovy-lib (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57283 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57283 being exploited in the wild.
How severe is CVE-2026-57283?
Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier; io.jenkins.plugins:pipeline-groovy-lib (Maven) < 4331.4333, ECOSYSTEM:introduced=0,fixed=4331.4333.
Is there a fix for CVE-2026-57283?
Yes. io.jenkins.plugins:pipeline-groovy-lib (Maven): upgrade to 4331.4333 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57283 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57283?
Check whether you run Jenkins Project Pipeline: Groovy Plugin or io.jenkins.plugins:pipeline-groovy-lib (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.jenkins.plugins:pipeline-groovy-lib (Maven): upgrade to 4331.4333 or later
    # set io.jenkins.plugins:pipeline-groovy-lib to 4331.4333 in your pom.xml or build.gradle

Technical details

The Jenkins Pipeline: Groovy Plugin (workflow-cps) fails to restrict the types that can be instantiated via the Pipeline Snippet Generator. It allows the instantiation of any type with a constructor annotated with @DataBoundConstructor, including those related to system or job configurations. Furthermore, the affected HTTP endpoint incorrectly supports GET requests and lacks CSRF protection. An attacker can exploit this by social engineering a victim into visiting a malicious URL, which triggers a request to instantiate objects or create script approval requests attributed to the victim. This can be leveraged to trick administrators into approving malicious scripts. The issue is fixed in version 4331.4333.v50a_b_076c5199.

Affected products

  • Jenkins Project Pipeline: Groovy Plugin (workflow-cps) 4331.v9d06ed4658ff and earlier

Identifiers

  • CVE-2026-57283
  • GHSA-72c8-3wwg-r59w

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory
  • 2026-06-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.