Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T16:17:30.950Z",
  "pubdate": "2026-09-02T16:17:30.950Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Jenkins Pipeline: Groovy Libraries Plugin, specifically affecting version 798.v5cc688825312 and earlier.\nThis vulnerability allows unauthenticated or unauthorized remote attackers to trigger unintended administrative actions by leveraging the session context of an authenticated Jenkins user.\nThe primary impact of this flaw is the unauthorized deletion of shared library caches, which can disrupt CI/CD pipelines, lead to build failures, and necessitate manual administrative intervention to restore the integrity of the build environment.\nThe vulnerability resides in the plugin's failure to properly validate CSRF protection tokens for specific HTTP requests directed at cache management functions.\nThe risk is elevated due to the nature of Jenkins as a central orchestration tool, where disruption to pipeline libraries can impact the availability and reliability of entire software development lifecycles.\nExploitation requires that an attacker tricks a legitimate, authenticated Jenkins administrator or user into visiting a malicious webpage or clicking a crafted link while their Jenkins session is active.",
  "technicalDetails": "The vulnerability is a classic CSRF, rooted in the Jenkins Pipeline: Groovy Libraries Plugin’s failure to implement or correctly enforce CSRF protection tokens (such as Jenkins' built-in crumb issuer) on endpoints responsible for managing shared library caches.\nIn the affected versions (798.v5cc688825312 and earlier), the HTTP methods—specifically those intended for administrative cache operations—do not perform state-changing validation, allowing an attacker to force the browser of an authenticated user to perform requests against the Jenkins server without the user's consent or knowledge.\nThe attack flow initiates when an attacker crafts a malicious payload, typically embedded within an HTML document or a script hosted on an external site. This payload is designed to issue an HTTP request (such as a POST or GET request) to the Jenkins server endpoint designated for cache manipulation.\nSince the Jenkins server uses browser-based authentication, the victim's browser automatically includes the necessary session cookies with the malicious request. Because the vulnerable Jenkins plugin component fails to require a valid CSRF token in the request headers or body, the Jenkins server processes the request as a legitimate command from the authenticated user.\nUpon successful execution, the plugin's backend logic proceeds to clear or delete the specified shared library caches. This results in the loss of cached resources, forcing the Jenkins Pipeline engine to perform fresh fetches or re-compilations of Groovy libraries during subsequent pipeline executions.\nThe post-exploitation impact includes a Denial of Service (DoS) condition concerning the pipeline cache, leading to increased build times, potential failures if external repository connectivity is intermittent or constrained, and a disruption in the continuous delivery process. Furthermore, if attackers can repeatedly trigger this, they can effectively block the efficient operation of pipelines dependent on these cached libraries.\nThis vulnerability is particularly dangerous because it does not require the attacker to have direct access to the Jenkins UI; it merely requires the victim to have an active session, making it a powerful tool for service disruption in enterprise environments relying on Jenkins Pipeline Groovy libraries."
}