CVE-2026-57284: Jenkins Pipeline Groovy Plugin unrestricted instantiation in Snippet Generator

CVE-2026-57284 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Pipeline: Groovy Plugin, which helps automate software build processes, contains a flaw in its code snippet generator. This tool fails to restrict which internal components it can create, allowing an attacker to potentially manipulate job or system configurations. Additionally, because the tool can be triggered via a simple web link, an attacker could trick an administrator into unintentionally performing actions that lead to the approval of malicious scripts.

Technologies: io.jenkins.plugins:pipeline-groovy-lib (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57284 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57284 being exploited in the wild.
How severe is CVE-2026-57284?
Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier; io.jenkins.plugins:pipeline-groovy-lib (Maven) < 4331.4333, ECOSYSTEM:introduced=0,fixed=4331.4333.
Is there a fix for CVE-2026-57284?
Yes. io.jenkins.plugins:pipeline-groovy-lib (Maven): upgrade to 4331.4333 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57284 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57284?
Check whether you run Jenkins Project Pipeline: Groovy Plugin or io.jenkins.plugins:pipeline-groovy-lib (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.jenkins.plugins:pipeline-groovy-lib (Maven): upgrade to 4331.4333 or later
    # set io.jenkins.plugins:pipeline-groovy-lib to 4331.4333 in your pom.xml or build.gradle

Technical details

The Pipeline: Groovy Plugin (workflow-cps) fails to restrict the types that can be instantiated through the Pipeline Snippet Generator endpoint. It will instantiate any type with a constructor annotated with @DataBoundConstructor in response to a request, rather than limiting instantiation to Pipeline steps. Furthermore, the affected HTTP endpoint incorrectly supports GET requests and lacks CSRF protection. An attacker can exploit this to instantiate types related to job or system configuration. In a social engineering scenario, this can be used to create script approval requests that appear to come from a trusted user, potentially leading to the execution of malicious scripts if an administrator is deceived into approving them. The issue is fixed in version 4331.4333.v50a_b_076c5199.

Affected products

  • Jenkins Project Pipeline: Groovy Plugin (workflow-cps) 4331.v9d06ed4658ff and earlier

Identifiers

  • CVE-2026-57284
  • GHSA-2w2h-gwwj-fh3q

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory
  • 2026-06-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.