CVE-2026-57284 Details
Description
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
A vulnerability exists in the Jenkins Pipeline: Groovy Plugin in versions through 4331.v9d06ed4658ff, allowing unrestricted instantiation of types through the Pipeline Snippet Generator. This flaw enables the creation of types related to job or system configuration, excluding Pipeline steps. The vulnerability also introduces a cross-site request forgery (CSRF) risk, as the Snippet Generator can be accessed via GET requests without authentication requirements, potentially leading to unauthorized script approval requests.
Users are advised to update the Pipeline: Groovy Plugin to version 4331.4333.v50a_b_076c5199, which restricts type instantiation to Pipeline steps and metastep delegates, and requires POST requests for the Snippet Generator endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3677 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins pipeline: groovy | <= 4331.v9d06ed4658ff |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |