Executive brief
The Jenkins Pipeline: Groovy Plugin, which helps automate software build processes, contains a flaw in its code snippet generator. This tool fails to restrict which internal components it can create, allowing an attacker to potentially manipulate job or system configurations. Additionally, because the tool can be triggered via a simple web link, an attacker could trick an administrator into unintentionally performing actions that lead to the approval of malicious scripts.
Technical details
The Pipeline: Groovy Plugin (workflow-cps) fails to restrict the types that can be instantiated through the Pipeline Snippet Generator endpoint. It will instantiate any type with a constructor annotated with @DataBoundConstructor in response to a request, rather than limiting instantiation to Pipeline steps. Furthermore, the affected HTTP endpoint incorrectly supports GET requests and lacks CSRF protection. An attacker can exploit this to instantiate types related to job or system configuration. In a social engineering scenario, this can be used to create script approval requests that appear to come from a trusted user, potentially leading to the execution of malicious scripts if an administrator is deceived into approving them. The issue is fixed in version 4331.4333.v50a_b_076c5199.
Affected products
- Jenkins Project Pipeline: Groovy Plugin (workflow-cps) 4331.v9d06ed4658ff and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched