CVE-2026-57298: Jenkins Contrast Continuous Application Security Plugin CSRF

CVE-2026-57298 · Severity: medium · CVSS 5.4 · Published 2026-06-24

The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software build process, contains a vulnerability that could allow an attacker to trick a user into making unauthorized requests. By exploiting this flaw, an attacker can force the Jenkins server to connect to a malicious web address using specific credentials, potentially exposing sensitive authentication keys or service information. This could lead to unauthorized access to external security services or the disclosure of internal configuration details.

Technologies: Jenkins Project Contrast Continuous Application Security Plugin, org.jenkins-ci.plugins:contrast-continuous-application-security (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57298 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57298 being exploited in the wild.
How severe is CVE-2026-57298?
Medium severity, with a CVSS score of 5.4, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier; org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) < 3.12, ECOSYSTEM:introduced=0,fixed=3.12.
Is there a fix for CVE-2026-57298?
Yes. org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57298 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57298?
Check whether you run Jenkins Project Contrast Continuous Application Security Plugin or org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later
    # set org.jenkins-ci.plugins:contrast-continuous-application-security to 3.12 in your pom.xml or build.gradle

Technical details

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier. The vulnerability allows an attacker to craft a malicious request that, if executed by a victim with sufficient privileges, causes the Jenkins controller to initiate an outbound connection to an attacker-specified URL. During this connection, Jenkins will utilize an attacker-specified username, API key, and service key. This can be used to perform Server-Side Request Forgery (SSRF) or to leak sensitive credentials to an external system. As of the advisory date, no patch has been explicitly detailed in the provided text, though users are generally advised to update to the latest version.

Affected products

  • Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier

Identifiers

  • CVE-2026-57298
  • GHSA-6qc4-57v3-28rr

Timeline

  • 2026-06-24: disclosed: Initial advisory publication by Jenkins Project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.