CVE-2026-48921 is a vulnerability in the Jenkins Pipeline: Groovy Libraries Plugin that permits attackers with control over a shared library used in a Pipeline job to leverage symbolic links to access arbitrary files on the Jenkins controller filesystem. The affected versions are 797.v90ea_a_9b_e45a_0 and earlier. The vulnerability arises because the plugin does not restrict the use of symbolic links in shared libraries, enabling unauthorized file read access. No CVSS score or vendor remediation details have been published yet.

An attacker able to influence the content of a shared library in a Jenkins Pipeline job can read arbitrary files on the Jenkins controller filesystem. This could lead to unauthorized disclosure of sensitive information stored on the controller. There is no information about exploitation in the wild or additional impacts such as code execution.

Patch status is not yet confirmed — check the Jenkins Project advisory for current remediation guidance. Until an official fix is available, restrict access to Jenkins Pipeline shared libraries to trusted users only and monitor for suspicious activity related to library usage.