CVE-2026-48921: Jenkins Pipeline: Groovy Libraries Plugin 797

Synopsis

This is a path-traversal vulnerability via symbolic link abuse in the Jenkins Pipeline: Groovy Libraries Plugin, affecting version 797.v90ea_a_9b_e45a_0 and earlier. The vulnerability is reachable over the network and requires a low-privilege account; an attacker who can control the contents of a shared library used by a Pipeline job can plant symbolic links that cause the Jenkins controller to read and expose files from its own filesystem. Successful exploitation results in full disclosure of arbitrary files on the Jenkins controller, including credentials, configuration secrets, and other sensitive data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Jenkins controller must be reachable over the network; an attacker interacts with the Pipeline job submission interface remotely.

• AuthenticationRequired

  The attacker must hold at least a low-privilege Jenkins account with enough access to contribute content to a shared library used by a Pipeline job.

• Victim interactionNot required

  No action by another user or administrator is needed; the attacker exploits the plugin behavior directly through their own pipeline or library contribution.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific conditions, such as controlling the content of a library that is actually consumed by a running Pipeline job, rather than exploiting a simple unconditional code path.

Blast Radius

• Reads arbitrary files from the Jenkins controller filesystem, including private keys, API tokens, and stored credentials.
• Exposes Jenkins configuration files that may contain connection strings, webhook secrets, or cloud provider credentials.
• Enables reconnaissance of the controller host's directory structure, aiding follow-on attacks against connected systems.