Executive brief
The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software development lifecycle, contains a security flaw due to missing permission checks. This allows users with basic read access to the Jenkins dashboard to force the server to connect to any web address they choose. An attacker could use this to probe internal network services or potentially leak sensitive credentials like API keys to a server they control.
Technical details
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to perform Server-Side Request Forgery (SSRF). The vulnerability exists in an HTTP endpoint that fails to validate user authorization before executing a connection test or similar outbound request. An attacker can specify a target URL, username, API key, and service key, which the Jenkins controller will then use to attempt a connection. This can be exploited to scan internal networks or exfiltrate the provided credentials to an attacker-controlled listener. As of the advisory date, users are advised to check for plugin updates from the Jenkins project.
Affected products
- Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory