Jenkins Groovy Libraries Plugin CVE-2026-84663

The victim must be an authenticated Jenkins user with sufficient permissions to delete shared library caches, and must be tricked into interacting with attacker-controlled web content (e.g., clicking a link or visiting a page) while their Jenkins authenticated session is active in the same browser. The attacker requires no credentials or privileges of their own. Exploitation is limited to environments running Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 or earlier. No special plugin configuration or non-default deployment mode is required - the vulnerable cache-deletion endpoint is available in standard plugin installations.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) yielding a score of 5.4 Medium accurately reflects the constrained impact. Attack complexity is low and no attacker privilege is required, but user interaction (a victim must navigate to a malicious page while authenticated to Jenkins) is mandatory - this materially limits opportunistic exploitation. Impact is confined to deleting shared library caches (no confidentiality breach, no code execution, no credential theft), resulting in low integrity and availability impact. EPSS data is absent from the input, and the vulnerability is not listed in CISA KEV, consistent with its moderate severity. No public exploit code has been reported. Real-world risk is moderate for organisations with externally-reachable Jenkins instances or where developers regularly browse untrusted sites while authenticated to Jenkins. The absence of C:H or I:H makes this a lower priority than most authenticated Jenkins vulnerabilities, but shared-library cache deletion could cascade into build failures in heavily pipeline-dependent environments.

An attacker hosts a web page containing a hidden HTML form or JavaScript fetch request targeting the Jenkins cache-deletion endpoint for the Groovy Libraries Plugin. A Jenkins developer is socially engineered - via phishing email or malicious link - into visiting the page while their Jenkins session is active in the same browser. The browser automatically submits the forged request, deleting shared library caches and potentially breaking downstream pipeline builds.