Database/Control plane, storage & DevOps

Jenkins Pipeline: Groovy Libraries plugin: CSRF lets an unauthenticated attacker delete library caches

CVE-2026-84663Control plane, storage & DevOpscurated

Impact

The cache-deletion endpoint has no CSRF protection, so an attacker who gets a logged-in Jenkins user to load a crafted page can wipe the controller's shared Groovy library caches. The effect is availability and load, not disclosure: every pipeline that pulls a shared library re-fetches it from SCM on the next run, which slows the queue and, if the SCM host is unreachable or rate-limiting, fails builds outright. It also forces a fresh fetch of library code at a moment the attacker chose, which is worth noting on controllers whose libraries come from a mutable branch rather than a pinned tag. Minor on its own; the reason it is here is that the attacker needs no Jenkins account at all, only a victim with one.

Who can reach it

Remote and unauthenticated (PR:N) but requires user interaction: a Jenkins user with an active session must visit an attacker-controlled page. No access to the controller's network from the attacker's side is needed beyond what the victim's browser has.

What to do

Upgrade the Pipeline: Groovy Libraries plugin past 798.v5cc688825312 per SECURITY-3815 in the 2026-09-02 Jenkins advisory; the advisory names that version and earlier as affected without stating a fixed release, so take the current plugin version. Cost is a controller restart to load the plugin - queue pause, agent reconnects, running builds lost unless drained.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-84663 https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3815

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.