CVE-2026-84663
Awaiting Analysis Awaiting Analysis - Queue

CSRF in Jenkins Pipeline Groovy Libraries Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-05
AI Q&A
2026-09-02
EPSS Evaluated
2026-09-03
NVD
CVE-2026-84663
EUVD
EUVD-2026-70129

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkinsci groovy_libraries_plugin to 798.v5cc688825312 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site request forgery (CSRF) vulnerability in the Jenkins Pipeline: Groovy Libraries Plugin versions 798.v5cc688825312 and earlier. It allows attackers to trick users into making unauthorized requests that delete shared library caches.

Detection Guidance

To detect this CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin, check the plugin version installed on your Jenkins server. If it is 798.v5cc688825312 or earlier, the system is vulnerable. Use the Jenkins script console or CLI to run: 'println(Jenkins.instance.pluginManager.plugins.findAll { it.shortName == "groovy-libraries" && it.version <= "798.v5cc688825312" })'. If any plugins match, update immediately.

Impact Analysis

An attacker could exploit this to delete shared library caches, potentially disrupting Jenkins builds that rely on those libraries. This may cause build failures or require manual restoration of deleted caches.

Compliance Impact

This CSRF vulnerability could potentially allow unauthorized actions, such as deleting shared library caches, which may impact data integrity and access controls. For GDPR, this could affect compliance with requirements for data protection and integrity (Article 32). For HIPAA, it might compromise the security of protected health information if unauthorized modifications occur.

Mitigation Strategies

Update Jenkins Pipeline: Groovy Libraries Plugin to version 798.v5cc688825312 or later to address the CSRF vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart