CVE-2026-48921

High

Description

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Jenkins Pipeline\

PublishedMay 27, 2026

First seenMay 27, 2026

Weakness typeCWE-59Improper link resolution

How to fix

Update

jenkins pipeline\798.v5cc688825312 or later
io.jenkins.plugins:pipeline-groovy-lib798.v5cc688825312 or later

Vendor advisories

jenkins.io/security/advisory/2026-05-27/#SECURITY-3727

Affected products

Product	Affected versions	Fixed in
jenkins pipeline\	_groovy_libraries ≤ v < 798.v5cc688825312	798.v5cc688825312
io.jenkins.plugins:pipeline-groovy-libMaven	v < 798.v5cc688825312	798.v5cc688825312

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.