CVE-2026-57283 Details

A cross-site request forgery (CSRF) vulnerability exists in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff. This vulnerability allows attackers to misuse the Pipeline Snippet Generator to instantiate types related to job or system configuration, excluding Pipeline steps. The vulnerability arises because the affected HTTP endpoint can be accessed via GET requests, without the need for POST, enabling CSRF attacks. Exploitation could involve creating a script approval request on behalf of another user, potentially leading to unauthorized script execution.

Users are advised to update to Jenkins Pipeline: Groovy Plugin version 4331.4333.v50a_b_076c5199, which addresses this vulnerability by restricting the types that can be instantiated through the Snippet Generator, requiring POST requests for the HTTP endpoint, and ensuring that only Pipeline steps and metastep delegates are instantiated.