CVE-2026-57284: Jenkins Pipeline Privilege Escalation

CVE-2026-57284 Overview

CVE-2026-57284 affects the Jenkins Pipeline: Groovy Plugin version 4331.v9d06ed4658ff and earlier. The plugin does not restrict the types that can be instantiated through the Pipeline Snippet Generator. Authenticated attackers can instantiate types related to job or system configuration that fall outside the intended scope of Pipeline steps. The flaw is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, also known as Unsafe Reflection). The Jenkins project published the issue in Jenkins Security Advisory #SECURITY-3677.

Critical Impact
Authenticated users with access to the Pipeline Snippet Generator can instantiate arbitrary Jenkins types, exposing job and system configuration data and enabling limited integrity impact.

Affected Products

Jenkins Pipeline: Groovy Plugin version 4331.v9d06ed4658ff
Jenkins Pipeline: Groovy Plugin versions earlier than 4331.v9d06ed4658ff
Jenkins controllers running the affected plugin with Pipeline Snippet Generator enabled

Discovery Timeline

2026-06-24 - Jenkins publishes Security Advisory #SECURITY-3677
2026-06-24 - CVE-2026-57284 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57284

Vulnerability Analysis

The Pipeline: Groovy Plugin provides the Pipeline Snippet Generator. The generator helps users build Pipeline step invocations through a guided web interface. The generator accepts a type name and instantiates a Java object using Jenkins data-bound construction. The affected versions accept type names beyond the set of legitimate Pipeline steps. Attackers with Overall/Read or comparable access can submit type names referencing job configuration or system configuration classes. The plugin then constructs those objects, which can expose internal configuration data or trigger side effects associated with object instantiation.

The weakness aligns with [CWE-470], where externally controlled input selects which class to instantiate. The Pipeline Snippet Generator does not enforce a type allowlist limited to Pipeline step descriptors.

Root Cause

The root cause is missing type validation inside the Snippet Generator request handler. The generator should restrict instantiation to subclasses of the Pipeline step descriptor hierarchy. The affected versions accept any Jenkins describable type. This makes the feature a general-purpose object factory accessible to authenticated users.

Attack Vector

Exploitation requires network access to the Jenkins UI and an authenticated session with permission to use the Snippet Generator. The attacker submits a crafted Snippet Generator request that names a non-step type. Jenkins constructs the object and returns generated content reflecting its state. The integrity impact is limited because the attack relies on side effects of construction rather than full configuration write. There is no confidentiality impact rated for arbitrary file disclosure, but configuration metadata may be exposed.

No verified public proof-of-concept code is available. Refer to the Jenkins Security Advisory #SECURITY-3677 for vendor-supplied technical details.

Detection Methods for CVE-2026-57284

Indicators of Compromise

Unusual POST requests to Pipeline Snippet Generator endpoints under /pipeline-syntax/ containing type names that do not correspond to known Pipeline step descriptors
Jenkins audit log entries showing Snippet Generator usage by accounts that do not normally author Pipelines
Stack traces or instantiation errors in the Jenkins system log referencing job or system configuration classes invoked through Snippet Generator code paths

Detection Strategies

Inspect Jenkins access logs for Snippet Generator requests and compare submitted descriptor identifiers against the published list of Pipeline step symbols
Enable Jenkins audit logging through the Audit Trail Plugin and alert on Snippet Generator activity outside expected developer workflows
Correlate Jenkins UI activity with authentication source IP addresses to identify low-privileged accounts probing the Snippet Generator

Monitoring Recommendations

Forward Jenkins controller logs, plugin logs, and reverse proxy access logs to a centralized analytics platform for retention and search
Track installed plugin versions across all Jenkins controllers and alert when Pipeline: Groovy Plugin remains at or below 4331.v9d06ed4658ff
Monitor for new or modified Jenkins jobs created by accounts that recently interacted with the Snippet Generator

How to Mitigate CVE-2026-57284

Immediate Actions Required

Upgrade the Jenkins Pipeline: Groovy Plugin to the fixed release listed in Jenkins Security Advisory #SECURITY-3677
Audit Jenkins user permissions and remove Overall/Read or job creation rights from accounts that do not require Pipeline authoring
Review recent Snippet Generator activity in access logs to identify exploitation attempts before patching

Patch Information

The Jenkins project addresses the issue in a fixed release of the Pipeline: Groovy Plugin documented in Jenkins Security Advisory #SECURITY-3677. The fix restricts the Pipeline Snippet Generator to instantiate only types that represent Pipeline steps. Apply the update through the Jenkins Update Center or by replacing the plugin .hpi file on the controller and restarting Jenkins.

Workarounds

Restrict access to the Pipeline Snippet Generator by limiting Job/Configure and Overall/Read permissions to trusted Pipeline authors until the patch is applied
Place Jenkins behind an authenticating reverse proxy and restrict /pipeline-syntax/ paths to specific developer network ranges
Disable anonymous and self-service signup on the Jenkins controller to reduce the pool of accounts that can reach the Snippet Generator

bash

# Identify the installed Pipeline: Groovy Plugin version on a Jenkins controller
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="workflow-cps") | {shortName, version, enabled}'