CVE-2026-57284

Analyzed Analyzed - Analysis Complete

Jenkins Pipeline Groovy Plugin Type Instantiation Flaw

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57284

EUVD

EUVD-2026-38764

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	pipeline	_groovy

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how CVE-2026-57284 affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in the Jenkins Pipeline Groovy Plugin version 4331.v9d06ed4658ff and earlier. It allows attackers to instantiate types related to job or system configuration through the Pipeline Snippet Generator without proper restrictions. Normally, only Pipeline steps should be instantiated, but this flaw permits broader access.

Impact Analysis

Because attackers can instantiate types related to job or system configuration, they may be able to manipulate Jenkins jobs or system settings in unauthorized ways. This could lead to unauthorized changes, potential disruption of CI/CD pipelines, or compromise of the Jenkins environment.

Hi! I’m here to help you understand CVE-2026-57284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70