CVE-2026-57297: Jenkins Contrast Continuous Application Security Plugin missing permission check

CVE-2026-57297 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software development lifecycle, contains a security flaw due to missing permission checks. This allows users with basic read access to the Jenkins dashboard to force the server to connect to any web address they choose. An attacker could use this to probe internal network services or potentially leak sensitive credentials like API keys to a server they control.

Technologies: Jenkins Project Contrast Continuous Application Security Plugin, org.jenkins-ci.plugins:contrast-continuous-application-security (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57297 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57297 being exploited in the wild.
How severe is CVE-2026-57297?
Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier; org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) < 3.12, ECOSYSTEM:introduced=0,fixed=3.12.
Is there a fix for CVE-2026-57297?
Yes. org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57297 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57297?
Check whether you run Jenkins Project Contrast Continuous Application Security Plugin or org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later
    # set org.jenkins-ci.plugins:contrast-continuous-application-security to 3.12 in your pom.xml or build.gradle

Technical details

A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to perform Server-Side Request Forgery (SSRF). The vulnerability exists in an HTTP endpoint that fails to validate user authorization before executing a connection test or similar outbound request. An attacker can specify a target URL, username, API key, and service key, which the Jenkins controller will then use to attempt a connection. This can be exploited to scan internal networks or exfiltrate the provided credentials to an attacker-controlled listener. As of the advisory date, users are advised to check for plugin updates from the Jenkins project.

Affected products

  • Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier

Identifiers

  • CVE-2026-57297
  • GHSA-p44q-fmwr-jqr7

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.