Jenkins Pipeline
Monthly
Path traversal in the Jenkins Pipeline: Groovy Libraries Plugin (805.va_fc79344957d and earlier) lets an authenticated user who can configure Pipelines point the `library` step at a path outside the SCM checkout and follow symbolic links, giving read access to files in a resources directory and the ability to delete files in a test directory on the Jenkins controller file system. Exploitation requires the Pipeline-configuration privilege, a symlink placed inside the checkout, and successful traversal during library retrieval, which is reflected in the high attack complexity of the assessed CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 4.2). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk is low-to-moderate and confined to file read and limited file deletion rather than arbitrary write or code execution.
Credential disclosure in Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier allows users who already hold Item/Configure permission to capture credentials they are not entitled to by authoring or modifying a Pipeline that invokes the resolveScm step, which fails to establish the correct context for credentials lookup. The issue is an access-control scoping flaw (CWE-863) rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting the authenticated Item/Configure prerequisite, the high complexity of targeting specific credential IDs, and impact limited to confidentiality with no integrity or availability effect. It requires a Jenkins instance that actually uses Pipeline/multibranch jobs with resolveScm; at time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the vendor advisory of 2026-09-16 should be reviewed for the fixed release.
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authenticated low-privilege user to cancel downstream pipeline builds they should not be able to touch. When a pipeline uses the `waitForBuild` step with the `propagateAbort` parameter enabled, aborting the upstream build propagates a cancel signal to downstream jobs without verifying whether the caller holds the required Item/Cancel permission on those downstream jobs. No public exploit has been identified at time of analysis, and EPSS data was not provided in the input.
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the `build` step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. Jenkins reported this in their 2026-09-02 security advisory (SECURITY-3870); no public exploit code has been identified at time of analysis.
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.
Path traversal in the Jenkins Pipeline: Groovy Libraries Plugin (805.va_fc79344957d and earlier) lets an authenticated user who can configure Pipelines point the `library` step at a path outside the SCM checkout and follow symbolic links, giving read access to files in a resources directory and the ability to delete files in a test directory on the Jenkins controller file system. Exploitation requires the Pipeline-configuration privilege, a symlink placed inside the checkout, and successful traversal during library retrieval, which is reflected in the high attack complexity of the assessed CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 4.2). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk is low-to-moderate and confined to file read and limited file deletion rather than arbitrary write or code execution.
Credential disclosure in Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier allows users who already hold Item/Configure permission to capture credentials they are not entitled to by authoring or modifying a Pipeline that invokes the resolveScm step, which fails to establish the correct context for credentials lookup. The issue is an access-control scoping flaw (CWE-863) rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting the authenticated Item/Configure prerequisite, the high complexity of targeting specific credential IDs, and impact limited to confidentiality with no integrity or availability effect. It requires a Jenkins instance that actually uses Pipeline/multibranch jobs with resolveScm; at time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the vendor advisory of 2026-09-16 should be reviewed for the fixed release.
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authenticated low-privilege user to cancel downstream pipeline builds they should not be able to touch. When a pipeline uses the `waitForBuild` step with the `propagateAbort` parameter enabled, aborting the upstream build propagates a cancel signal to downstream jobs without verifying whether the caller holds the required Item/Cancel permission on those downstream jobs. No public exploit has been identified at time of analysis, and EPSS data was not provided in the input.
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the `build` step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. Jenkins reported this in their 2026-09-02 security advisory (SECURITY-3870); no public exploit code has been identified at time of analysis.
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.