CSRF in Jenkins Zowe zDevOps Plugin Credential Exposure

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57306

EUVD

EUVD-2026-38787

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	zowe_zdevops	to 1.1.3.50.ve350c9b_450b_1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) issue found in the Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier. It allows attackers to make Jenkins connect to a URL specified by the attacker using credentials IDs that the attacker has obtained through other means. Essentially, the attacker can trick Jenkins into using stored credentials to connect to malicious URLs.

Impact Analysis

The impact of this vulnerability is that an attacker can capture credentials stored in Jenkins by forcing Jenkins to connect to attacker-controlled URLs using those credentials. This can lead to unauthorized access to sensitive systems or data, potentially compromising the security of your Jenkins environment and any connected resources.

Hi! I’m here to help you understand CVE-2026-57306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70