Jenkins Pipeline Plugin EUVD-2026-38764

Exploitation requires a valid, authenticated Jenkins user account with at minimum low-level access (PR:L confirmed by CVSS vector). The attacker must be able to reach the Pipeline Snippet Generator interface within the Jenkins web UI, which is available to users holding Job/Read or equivalent permissions. The vulnerability is triggered by supplying a type reference to the generator that corresponds to a job or system configuration class rather than a Pipeline step. Exploitation is bounded by the authentication prerequisite - anonymous or unauthenticated users cannot reach this interface. The SSVC rating of Automatable: no indicates the exploitation path is not trivially scriptable for mass targeting, further limiting realistic exposure to insider or compromised-credential scenarios.

The NVD CVSS score of 4.3 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) captures the low-complexity, low-privilege network attack surface but rates confidentiality impact as none. This is worth scrutinizing: the intelligence tags include 'Information Disclosure,' suggesting that instantiating configuration-related types may expose sensitive data beyond what C:N implies - a potential gap in the official scoring. EPSS at 0.24% (15th percentile) reinforces low near-term exploitation probability. CISA SSVC explicitly rates exploitation as none, automatable as no, and technical impact as partial, which is consistent with the restricted scope: only authenticated users with access to the Snippet Generator UI are exposed. No KEV listing and no public POC further depress real-world risk. The net assessment is a genuine but low-urgency patch: organizations with large, broadly-permissioned Jenkins user bases face greater exposure than those with tightly controlled access.

An authenticated Jenkins user with low-level Job/Read access navigates to the Pipeline Snippet Generator in the Jenkins web UI and submits a crafted request referencing a non-Pipeline type such as a system configuration or credential binding class. The plugin instantiates the requested type without restriction, exposing internal configuration state or allowing the user to manipulate job settings beyond their assigned permission level. No public exploit code is referenced in available sources, but the web-accessible entry point and low privilege bar make this feasible for any internal Jenkins user.