Jenkins Extensible Choice Parameter Plugin: CSRF lets an unauthenticated attacker run sandboxed Groovy

Impact

A missing CSRF protection lets an attacker who can get a logged-in Jenkins user to load a crafted page cause the controller to evaluate attacker-supplied Groovy in the script sandbox. The sandbox is a real boundary, so this is not controller root on its own - the record scores it as partial integrity and availability only - but sandboxed script execution on the controller is a useful foothold and historically a staging point for sandbox-bypass chains. On a CI controller that drives GPU driver builds and image promotion, anything that executes on the controller sits upstream of what lands on the nodes.

Who can reach it

Network, unauthenticated attacker, but requires user interaction: a Jenkins user with a valid session must visit the attacker's page.

What to do

Update the Extensible Choice Parameter Plugin past 239.v5f5c278708cf and restart the Jenkins controller; the advisory names no fixed version, so if none is published, remove the plugin or restrict who can reach the controller UI. Ensuring the controller is not reachable from general-purpose browsing networks reduces the CSRF window.

References

Related entries

• Jenkins Publish to Bitbucket Plugin: low-privilege users can make Jenkins send stored credentials to an attacker URLCVE-2025-64149 · Jenkins Publish to Bitbucket Plugin (credential capture via unauthorized connection)Medium
• Ansible Automation Platform UI: DOM XSS via unvalidated `next` redirect parameterCVE-2026-106033 · Red Hat Ansible Automation Platform UI (redirect route `next` parameter)Medium
• GitLab CE/EE: missing enforcement checks let an authenticated user bypass SAML SSO restrictionsCVE-2026-12910 · GitLab CE/EE (SAML SSO sign-in enforcement)Medium
• Grafana: an Editor can mark a dashboard file-provisioned, making it undeletable by adminsCVE-2026-13720 · Grafana dashboard API (grafana.app/managedBy provisioning annotations)Medium
• GitLab EE: missing namespace validation lets a user apply compliance frameworks from namespaces they cannot accessCVE-2026-4398 · GitLab EE self-managed (compliance framework namespace validation)Medium
• LibreNMS: reflected XSS in the Proxmox view runs script in a logged-in monitoring user's sessionCVE-2026-45694 · LibreNMS (Proxmox application view, instance and vmid parameters)Medium