CVE-2026-84663: Jenkins Pipeline Groovy Libraries CSRF Flaw

CVE-2026-84663 Overview

CVE-2026-84663 is a cross-site request forgery (CSRF) vulnerability in the Jenkins Pipeline: Groovy Libraries Plugin. The flaw affects version 798.v5cc688825312 and earlier releases. Attackers who trick authenticated Jenkins users into visiting a malicious page can delete shared library caches on the target instance. The issue is tracked under CWE-352 and documented in the Jenkins Security Advisory 2026-09-02.

Critical Impact
Attackers can delete Jenkins shared library caches through forged requests, disrupting pipeline execution and forcing rebuilds of cached dependencies.

Affected Products

Jenkins Pipeline: Groovy Libraries Plugin version 798.v5cc688825312
All prior versions of the Pipeline: Groovy Libraries Plugin
Jenkins controllers that load pipelines through the affected plugin

Discovery Timeline

2026-09-02 - Jenkins publishes Security Advisory SECURITY-3815
2026-09-02 - CVE-2026-84663 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84663

Vulnerability Analysis

The Pipeline: Groovy Libraries Plugin exposes an endpoint that deletes cached shared libraries. The endpoint does not require a POST request or a valid CSRF crumb. An attacker who lures an authenticated Jenkins user with sufficient permissions to visit a malicious web page can trigger the deletion. The resulting impact is limited to integrity and availability: cached content is removed, which forces Jenkins to refetch shared libraries on the next pipeline run. The vulnerability requires user interaction, so exploitation depends on social engineering the target user.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint. The plugin accepts GET requests and does not validate a Jenkins crumb before performing the cache deletion. Under Jenkins' web security model, state-changing actions must be POST-only and crumb-validated. The affected handler violates this contract, which allows cross-origin requests to trigger destructive actions.

Attack Vector

Exploitation occurs over the network without authentication of the attacker. The attacker hosts a page containing an HTML element or script that issues a request to the vulnerable Jenkins endpoint. When an authenticated user with permission to manage the plugin visits the page, the browser attaches the user's session cookies to the request. Jenkins processes the request as if the user had initiated it, and the shared library cache is deleted.

No verified exploit code is available for CVE-2026-84663. Refer to the Jenkins Security Advisory 2026-09-02 for authoritative technical details.

Detection Methods for CVE-2026-84663

Indicators of Compromise

Unexpected deletion events in Jenkins shared library cache directories on the controller filesystem.
Sudden pipeline slowdowns caused by full library re-checkout after cache invalidation.
Jenkins access logs showing GET requests to Pipeline: Groovy Libraries plugin cache-management URLs originating from unusual Referer headers.

Detection Strategies

Correlate Jenkins HTTP access logs with authenticated user sessions to identify cache-deletion requests that lack an internal Referer.
Monitor plugin audit logs for cache deletion actions and alert when the initiating page is external.
Track pipeline execution times to detect anomalies consistent with forced cache rebuilds across multiple jobs.

Monitoring Recommendations

Forward Jenkins controller HTTP and audit logs to a centralized log platform for retention and correlation.
Enable Jenkins' built-in audit trail plugin and alert on shared library cache deletion events.
Baseline normal cache turnover for pipelines and alert on statistical deviations.

How to Mitigate CVE-2026-84663

Immediate Actions Required

Upgrade the Pipeline: Groovy Libraries Plugin to a version later than 798.v5cc688825312 once available in the Jenkins update center.
Restrict plugin administrative permissions to a minimum set of trusted users.
Educate Jenkins administrators about CSRF risks and the danger of browsing untrusted sites while authenticated to Jenkins.

Patch Information

Apply the fixed version referenced in the Jenkins Security Advisory 2026-09-02 for SECURITY-3815. Update through the Jenkins plugin manager and restart the controller if required.

Workarounds

Isolate Jenkins controllers behind an authenticated reverse proxy that enforces strict Referer and Origin header validation.
Require administrators to use a dedicated browser profile for Jenkins access to reduce cross-site attack surface.
Temporarily reduce the number of accounts with permission to manage shared library caches until the patched plugin is installed.

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i "pipeline-groovy-lib"