CVE-2026-22018-Jenkins-Pipeline-Shared-Library-Code-Execution-via-Grab-

CVE-2026-22018 – Jenkins Pipeline Shared Library Code Execution via @Grab Program Code Groovy pipeline // Jenkinsfile - loads untrusted shared library @Library'evil-library@master' node evilStep CVE-2026-22018 – Jenkins Pipeline Shared Library Remote Code Execution Overview A Jenkins pipeline loa...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

CVE-2026-92130

The Jenkins Pipeline: Multibranch Plugin (workflow-multibranch) versions 841.vec5b_9e1806ec and earlier contains a vulnerability where it fails to set the appropriate context for credentials lookup during the resolveScm Pipeline step. This flaw allows attackers with Item/Configure permissions to ...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

EUVD-2026-80754

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92131

The Jenkins Pipeline: Groovy Libraries Plugin (version 805.va_fc79344957d and earlier) is vulnerable to a path traversal flaw. The plugin fails to restrict the library path provided to the library Pipeline step to a relative path within the SCM checkout and improperly follows symbolic links to lo...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

EUVD-2026-80755

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

CVE-2026-92131: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

CVE-2026-92130: Incorrect Authorization

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

CVE-2026-84663: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

CVE-2026-84660: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

PT-2026-84784

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b 67ea 11b 152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream...

CVE-2026-84661: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

Exploit for Allocation of Resources Without Limits or Throttling in Oracle Jre

--- CVE-2026-22018 – Jenkins Pipeline Shared Library Code Ex...

CVE-2026-57283

A flaw was found in Jenkins Pipeline: Groovy Plugin. This cross-site request forgery CSRF vulnerability allows attackers to instantiate types related to job or system configuration. This could enable unauthorized modifications to the Jenkins environment...