Medium severity · published Jun 24, 2026
CVE-2026-57284
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to…
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jenkins Pipeline: Groovy Plugin · Jenkins Project
through 4331.v9d06ed4658ff · source: vendor
PG
Pipeline: Groovy · Jenkins
through 4331.v9d06ed4658ff · source: NVD
Affected product
JP
Jenkins Pipeline: Groovy Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57284
Vendor Advisory
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3677
More from Jenkins Pipeline: Groovy Plugin
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.9
CVE-2022-43402
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier…
4.3
CVE-2026-57283
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system…