CVE-2024-52550: Jenkins Pipeline Auth Bypass Vulnerability

CVE-2024-52550 Overview

CVE-2024-52550 affects the Jenkins Pipeline: Groovy Plugin, version 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3. The plugin fails to verify whether the main Jenkinsfile script for a rebuilt build has been approved before execution. Attackers holding Item/Build permission can rebuild a previous build whose Jenkinsfile script is no longer approved. This bypasses Jenkins script approval controls and enables execution of previously revoked Groovy pipeline code.

Critical Impact
Authenticated users with build permissions can re-execute unapproved Groovy scripts, bypassing script security controls to compromise the Jenkins controller and connected build agents.

Affected Products

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier
All versions prior to 3990.vd281dd77a_388 (excluding the fixed line 3975.3977.v478dd9e956c3)
Jenkins controllers running the vulnerable plugin with granted Item/Build permissions

Discovery Timeline

2024-11-13 - Jenkins Security Advisory SECURITY-3362 published
2024-11-13 - CVE-2024-52550 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52550

Vulnerability Analysis

Jenkins uses a script approval mechanism to gate execution of Groovy code that runs outside the sandbox. Administrators approve individual scripts, and approvals can be revoked when scripts are deemed unsafe or outdated. The Pipeline: Groovy Plugin implements the pipeline execution engine that interprets Jenkinsfile contents. Under normal conditions, the plugin validates approval before executing an out-of-sandbox script. This validation is omitted on the rebuild code path. This vulnerability is categorized under [CWE-354] Improper Validation of Integrity Check Value.

When a user triggers a rebuild of an earlier build, the plugin reuses the stored Jenkinsfile from that build record without rechecking the current approval state. A previously approved script that was later revoked remains executable through the rebuild function. Users granted only Item/Build, not administrative privileges, can exercise this path.

Root Cause

The root cause is a missing script approval check in the rebuild handler of the Pipeline: Groovy Plugin. The plugin trusts historical approval status implicitly rather than revalidating against the current script approval registry at build time.

Attack Vector

An authenticated attacker with Item/Build permission identifies a job whose historical build ran a Groovy Jenkinsfile that was later unapproved. The attacker invokes the rebuild action on that build. The plugin re-executes the unapproved script on the Jenkins controller, granting access to Jenkins internals, credentials, and connected agents. Refer to the Jenkins Security Advisory SECURITY-3362 for vendor technical details.

Detection Methods for CVE-2024-52550

Indicators of Compromise

Rebuild actions targeting builds whose Jenkinsfile scripts appear in the unapproved list under Manage Jenkins > In-process Script Approval
Pipeline builds executing Groovy methods or classes not present in the current approved signatures list
Unexpected process execution, credential access, or agent commands originating from Jenkins controller pipeline runs

Detection Strategies

Audit Jenkins build history for rebuild events on jobs whose scripts were pending or revoked approval
Correlate Item/Build permission usage against script approval state changes recorded in scriptApproval.xml
Monitor Jenkins system logs for groovy.lang execution entries tied to rebuild triggers rather than fresh commits

Monitoring Recommendations

Forward Jenkins access and audit logs to a centralized SIEM and alert on rebuild actions by non-administrator accounts
Track modifications to scriptApproval.xml and pair those events with subsequent build executions of the affected pipelines
Alert on new outbound network connections, credential retrievals, or shell invocations from Jenkins controller processes following a rebuild

How to Mitigate CVE-2024-52550

Immediate Actions Required

Upgrade the Pipeline: Groovy Plugin to a version newer than 3990.vd281dd77a_388, or to the LTS fix line 3975.3977.v478dd9e956c3
Review the current unapproved scripts list and remove or purge unapproved historical build records that could be rebuilt
Restrict Item/Build permission to trusted users on jobs that execute out-of-sandbox Groovy code

Patch Information

The Jenkins project fixed CVE-2024-52550 in Pipeline: Groovy Plugin version 3990.3992.v4a_4b_b_e039fb_d and later, and backported the fix to LTS line 3975.3977.v478dd9e956c3. Consult the Jenkins Security Advisory SECURITY-3362 for the complete patch matrix.

Workarounds

Disable the rebuild plugin or remove the rebuild action from affected pipeline jobs until patching is complete
Purge build history for pipelines whose historical Jenkinsfile scripts are no longer approved
Enforce pipeline sandbox mode across all jobs to reduce the population of scripts subject to script approval

bash

# Verify installed Pipeline: Groovy Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins workflow-cps

# Upgrade using the Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin workflow-cps -restart