EUVD-2026-38763
GHSA-72c8-3wwg-r59w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CSRF canonically requires victim interaction (UI:R); PR:L confirmed because authentication is required; no confidentiality or availability impact applies.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.
AnalysisAI
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.
Technical ContextAI
The Jenkins Pipeline: Groovy Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_pipeline:_groovy_plugin) provides the Pipeline Snippet Generator, a UI and API facility that helps users construct Groovy DSL snippets for declarative/scripted pipelines. The root cause is CWE-352 (Cross-Site Request Forgery): the Snippet Generator endpoint does not enforce Jenkins' standard CSRF crumb validation. This allows a crafted request - whether originating cross-site or directly from an authenticated low-privilege session - to invoke the type-instantiation logic without a valid anti-forgery token. The impact is limited to types that map to job or system configuration objects, not general arbitrary code execution via Groovy, distinguishing this from more severe Script Security bypass issues in the same plugin family.
RemediationAI
The primary remediation is upgrading the Jenkins Pipeline: Groovy Plugin to a version beyond 4331.v9d06ed4658ff as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3677. An exact fixed release version number was not included in the available data - administrators should consult the Jenkins Update Center and the advisory directly to identify the current patched release. As a compensating control pending upgrade, restricting access to the Pipeline Snippet Generator endpoint via Jenkins' role-based access control (RBAC) to only highly trusted users limits the set of principals who can trigger the vulnerable code path; the trade-off is reduced self-service pipeline authoring capability for less-privileged users. Enforcing network-level controls (firewall or reverse-proxy rules) to prevent untrusted external origins from reaching the Jenkins web interface reduces cross-site request feasibility but does not eliminate exploitation by already-authenticated internal users.
More in Jenkins Pipeline
View allUnauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authe
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authentic
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthentic
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce t
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today