Executive brief
A vulnerability in the Jenkins Pipeline: Groovy Plugin allows attackers to trick authorized users into performing unintended actions via Cross-Site Request Forgery (CSRF). This specific flaw can be used to generate unauthorized script approval requests, potentially leading an administrator to unknowingly approve malicious code. The plugin is a core component used to define and run automated build workflows in Jenkins.
Technical details
The Jenkins Pipeline: Groovy Plugin (workflow-cps) fails to restrict the types that can be instantiated via the Pipeline Snippet Generator. It allows the instantiation of any type with a constructor annotated with @DataBoundConstructor, including those related to system or job configurations. Furthermore, the affected HTTP endpoint incorrectly supports GET requests and lacks CSRF protection. An attacker can exploit this by social engineering a victim into visiting a malicious URL, which triggers a request to instantiate objects or create script approval requests attributed to the victim. This can be leveraged to trick administrators into approving malicious scripts. The issue is fixed in version 4331.4333.v50a_b_076c5199.
Affected products
- Jenkins Project Pipeline: Groovy Plugin (workflow-cps) 4331.v9d06ed4658ff and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched