This vulnerability is a cross‑site request forgery that allows an attacker to invoke the endpoint that removes cached copies of shared libraries used by Jenkins Pipeline jobs. When triggered, the attacker can force the Jenkins instance to clear its repository of previously downloaded library code, leading to loss of build artefacts and a disruption of continuous integration processes. Because the flaw only grants the ability to delete cached libraries, it does not provide direct code execution or privilege escalation, but the resulting denial of service to automated builds can have significant operational impact.

The vulnerability affects the Jenkins Pipeline: Groovy Libraries Plugin versions 798.v5cc688825312 and earlier. The plugin is distributed by the Jenkins Project and is a core component used by many Jenkins installations to manage shared library dependencies.

The CVSS score of 5.4 indicates a moderate level of risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower current exploitation activity. Based on the description, the likely attack vector is a CSRF request made within the context of the victim’s authenticated Jenkins session. An attacker would need to entice a user into submitting a crafted request or leverage an existing authenticated session to trigger the cache deletion endpoint. The impact is confined to the Jenkins instance’s build environment and does not compromise its overall integrity or confidentiality.