CVE-2026-57283

Analyzed Analyzed - Analysis Complete

Cross-Site Request Forgery in Jenkins Pipeline Groovy Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57283

EUVD

EUVD-2026-38763

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	pipeline	_groovy

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) issue found in the Jenkins Pipeline: Groovy Plugin version 4331.v9d06ed4658ff and earlier. It allows attackers to instantiate types related to job or system configuration, other than the intended Pipeline steps, through the Pipeline Snippet Generator.

Impact Analysis

An attacker exploiting this vulnerability could potentially manipulate Jenkins job or system configurations by instantiating unauthorized types. This could lead to unauthorized changes in the Jenkins environment, potentially disrupting build processes or compromising system integrity.

Compliance Impact

The provided information does not specify how the CVE-2026-57283 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-57283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70