What is the CVSS score of CVE-2026-48921?

CVE-2026-48921 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Groovy Libraries Plugin are affected by CVE-2026-48921?

The Jenkins Pipeline: Groovy Libraries Plugin (version 797.v90ea_a_9b_e45a_0 and earlier) allows attackers with write access to shared library repositories to exfiltrate credentials, API tokens, and…. A patch is available.

How to fix or mitigate CVE-2026-48921?

24 hours: Inventory all Jenkins instances and identify Pipeline: Groovy Libraries Plugin version via Manage Jenkins > Manage Plugins. Restrict commit access to all shared library repositories to approved developers only with MFA enforcement. 7 days: Implement mandatory peer code review for all shared library changes before merge. Audit Jenkins credential stores and rotate secrets that could have been read via symlinks. 30 days: Monitor Jenkins security advisories for patch to Pipeline: Groovy Libraries Plugin; plan immediate upgrade upon vendor release.

Groovy Libraries Plugin CVE-2026-48921

EUVD-2026-32512 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-qjq3-wqj5-g37q

Information Disclosure Jenkins Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:13 vuln.today

CVSS changed

May 27, 2026 - 20:22 NVD

7.5 (None) 7.5 (HIGH)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on io.jenkins.plugins:pipeline-groovy-lib (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 798.v5cc688825312.

DescriptionCVE.org

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

AnalysisAI

Arbitrary file read on the Jenkins controller is possible in the Jenkins 'Pipeline: Groovy Libraries Plugin' (version 797.v90ea_a_9b_e45a_0 and earlier), where the plugin fails to prohibit symbolic links inside shared libraries. An attacker who can control the contents of a shared library consumed by a Pipeline job can plant symlinks that resolve to sensitive files (credentials, secrets, configuration) on the controller filesystem and exfiltrate them through the build. There is no public exploit identified at time of analysis, and SSVC marks exploitation status as none, so this is a patch-and-move-on issue rather than an active-exploitation emergency.

Technical ContextAI

The affected component is the Jenkins 'Pipeline: Groovy Libraries Plugin', which lets Pipeline jobs load reusable Groovy code from 'shared libraries' typically backed by an SCM repository (Git, etc.). When such a library is retrieved and checked out, its files are placed on the Jenkins controller. The root cause is CWE-59 (Improper Link Resolution Before File Access, i.e., link following / a symlink attack): the plugin does not strip or reject symbolic links contained in the library, so a symlink committed into the library will be followed and resolved against the controller's real filesystem rather than being confined to the library workspace. This is a classic path-confinement failure where untrusted, attacker-supplied repository content is materialized on a privileged host without sanitizing links.

RemediationAI

Upgrade the Jenkins 'Pipeline: Groovy Libraries Plugin' to the fixed release published in the Jenkins security advisory; the exact patched version number is not present in the provided input data, so consult https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3727 and the Jenkins update center for the specific fixed version rather than relying on an invented version string. Until you can update, reduce exposure by restricting who can author or modify shared libraries: limit global/folder-level shared library definitions to trusted administrators, and require that library SCM repositories are write-restricted so untrusted users cannot commit symlinks (trade-off: slows down self-service library development). Prefer pinning libraries to specific trusted revisions and disabling 'allow default version to be overridden' / dynamic loading where feasible (trade-off: less flexibility for job authors). Audit recent builds that loaded shared libraries for unexpected symlinks or file access, and rotate any controller secrets that an untrusted library author could have read if you suspect exposure.