CVE-2026-57301 Details
Description
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
A vulnerability in the OWASP ZAP Plugin for Jenkins, specifically in versions through 1.0.7, allows for arbitrary code execution on the Jenkins controller. This issue arises because the plugin performs build operations on the controller instead of the designated agent. Attackers with Item/Configure permission can exploit this flaw by configuring the plugin to execute an attacker-controlled project, thereby executing malicious code on the controller.
As of the publication of this advisory, no fix is available for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3649 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins official owasp zap | <= 1.0.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |