CVE-2026-84663

MediumCVSS 5.4

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

Risk Assessment

An attacker can force a logged-in user to perform an unwanted action of deleting the cache, which may disrupt pipeline operations and increase system load.

Recommendation

Update the Pipeline: Groovy Libraries plugin to a version that fixes the CSRF vulnerability. Additionally, consider enabling CSRF protection in Jenkins and restricting access to administrative functions.

Other vulnerabilities in Jenkins Pipeline: Groovy Libraries Plugin

CVE-2026-48921High
The Groovy Libraries Plugin in Jenkins Pipeline version 797.v90ea_a_9b_e45a_0 and earlier does not prohibit the use of symbolic links in shared libraries. This allows attackers who can control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Original NVD description (English source)

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.