Description
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline: Shared Groovy Libraries Plugin | unspecified – ≤ 552.vd9cc05b8a2e1 | 2.21.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.21.5-3.rhaos4.8.gitaf64931.el7 | RHSA-2022:0871 |
| Red Hat OpenShift 4 | haproxy +1 | 2.0.16-3.el7 | RHSA-2022:1620, RHSA-2022:1021 |
| Red Hat OpenShift 4 | haproxy22 | 2.2.15-4.el8 | RHSA-2022:1021 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1650364520-1.el8 | RHSA-2022:1620, RHSA-2022:1248, RHSA-2022:1025 |
| Red Hat OpenShift 3 | jenkins | 2.319.3.1650348949-1.el7 | RHSA-2022:1420 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1650371376-1.el7 | RHSA-2022:1420 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps-global-lib | >= 544.vff04fa68714d, < 561.va | 561.va | GHSA-g9fx-6j5c-grmw |
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps-global-lib | >= 2.19, < 2.21.1 | 2.21.1 | GHSA-g9fx-6j5c-grmw |
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps-global-lib | < 2.18.1 | 2.18.1 | GHSA-g9fx-6j5c-grmw |
Advisories 6
- RHSA-2022:1420 Red Hat Security Advisory: OpenShift Container Platform 3.11.685 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:1021 Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1620 Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:0871 Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1025 Red Hat Security Advisory: OpenShift Container Platform 4.10.6 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:1248 Red Hat Security Advisory: OpenShift Container Platform 4.7.48 packages and security update Red Hat Security Advisories (RHSA) · Mar 21, 2026