CVE-2021-21627: CSRF vulnerability in Jenkins Libvirt Agents Plugin
Summary
CVE-2021-21627: CSRF vulnerability in Jenkins Libvirt Agents Plugin. Affects org.jenkins-ci.plugins:libvirt-slave versions < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Libvirt Agents Plugin is a Maven package that provides integration between Jenkins and libvirt, allowing Jenkins to manage and control virtual machines. It enables Jenkins to start, stop, and monitor hypervisor domains using the libvirt API. The plugin is widely used in Jenkins environments that utilize virtualization technologies.
Vulnerability Detail
The Libvirt Agents Plugin version 1.9.0 and earlier is vulnerable to a cross-site request forgery (CSRF) attack. The plugin does not require POST requests for a form submission endpoint, allowing an attacker to trick a user into performing unintended actions on their behalf. In this case, the vulnerability allows attackers to stop hypervisor domains, potentially disrupting the virtualization infrastructure. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.
How To Fix
Latest published version: 325.ve30f881b_95c9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CSRF vulnerability in the Jenkins Libvirt Agents Plugin (CVE-2021-21627) can be mitigated by upgrading to version 1.9.1 or later. This will prevent attackers from stopping hypervisor domains and ensure the security and availability of virtual machines in Jenkins environments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:libvirt-slave →
FAQ
The vulnerability allows attackers to stop hypervisor domains, potentially disrupting virtualization infrastructure and affecting the availability of virtual machines.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There is no known exploit available for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential attacks.
The recommended mitigation is to upgrade to version 1.9.1 or later of the Libvirt Agents Plugin. This will ensure that POST requests are required for the affected HTTP endpoint, preventing CSRF attacks.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database) under the advisory ID GHSA-mm5c-7mpr-99fm.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:libvirt-slave.
