EUVD-2026-38764
GHSA-2w2h-gwwj-fh3q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
C:L added over official C:N to reflect information disclosure potential from configuration object access flagged in intelligence tags; PR:L and AV:N confirmed by authentication requirement and web UI access vector.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
AnalysisAI
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.
Technical ContextAI
The Jenkins Pipeline: Groovy Plugin provides a Snippet Generator UI that assists users in constructing Pipeline DSL step code. Internally, this generator must instantiate Java/Groovy types corresponding to Pipeline steps. CWE-470 (Use of Externally-Controlled Input to Select Classes or Code - Unsafe Reflection) identifies the root cause: the plugin accepts user-supplied type references without validating them against an approved allowlist of Pipeline step classes, permitting reflection-based instantiation of arbitrary registered types including those representing job configuration, system settings, or credential stores. The affected CPE is cpe:2.3:a:jenkins_project:jenkins_pipeline:_groovy_plugin covering all versions up to and including 4331.v9d06ed4658ff.
RemediationAI
The primary fix is to upgrade the Jenkins Pipeline: Groovy Plugin to any version released after 4331.v9d06ed4658ff. The Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3677 should be consulted for the exact patched release identifier, as a specific fixed version number is not independently confirmed in the available intelligence data. As a compensating control prior to patching, administrators should audit and tighten Jenkins permission assignments: restrict Overall/Read, Job/Configure, and Job/Build permissions to explicitly trusted users, thereby limiting which accounts can reach the Pipeline Snippet Generator. Additionally, enabling the Script Security plugin's Groovy sandbox and requiring administrator approval for script operations reduces the potential impact of type instantiation abuse. Note that permission restriction alone does not eliminate the vulnerability - it only reduces the population of users who can trigger it.
More in Jenkins Pipeline
View allCross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthentic
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authe
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authentic
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enab
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today