Jenkins Pipeline
Monthly
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authenticated low-privilege user to cancel downstream pipeline builds they should not be able to touch. When a pipeline uses the `waitForBuild` step with the `propagateAbort` parameter enabled, aborting the upstream build propagates a cancel signal to downstream jobs without verifying whether the caller holds the required Item/Cancel permission on those downstream jobs. No public exploit has been identified at time of analysis, and EPSS data was not provided in the input.
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the `build` step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. Jenkins reported this in their 2026-09-02 security advisory (SECURITY-3870); no public exploit code has been identified at time of analysis.
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthenticated remote attackers to delete shared library caches by tricking an authenticated Jenkins user into visiting a malicious page. The impact affects pipeline integrity and build availability, as deleted caches force library re-fetching and can disrupt CI/CD workflows. No public exploit or KEV status has been identified at time of analysis; the vulnerability was disclosed by Jenkins in its September 2, 2026 security advisory (SECURITY-3815).
Unauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authenticated low-privilege user to cancel downstream pipeline builds they should not be able to touch. When a pipeline uses the `waitForBuild` step with the `propagateAbort` parameter enabled, aborting the upstream build propagates a cancel signal to downstream jobs without verifying whether the caller holds the required Item/Cancel permission on those downstream jobs. No public exploit has been identified at time of analysis, and EPSS data was not provided in the input.
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the `build` step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. Jenkins reported this in their 2026-09-02 security advisory (SECURITY-3870); no public exploit code has been identified at time of analysis.
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.