Executive brief
The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software build process, contains a vulnerability that could allow an attacker to trick a user into making unauthorized requests. By exploiting this flaw, an attacker can force the Jenkins server to connect to a malicious web address using specific credentials, potentially exposing sensitive authentication keys or service information. This could lead to unauthorized access to external security services or the disclosure of internal configuration details.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier. The vulnerability allows an attacker to craft a malicious request that, if executed by a victim with sufficient privileges, causes the Jenkins controller to initiate an outbound connection to an attacker-specified URL. During this connection, Jenkins will utilize an attacker-specified username, API key, and service key. This can be used to perform Server-Side Request Forgery (SSRF) or to leak sensitive credentials to an external system. As of the advisory date, no patch has been explicitly detailed in the provided text, though users are generally advised to update to the latest version.
Affected products
- Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier
Timeline
- 2026-06-24: disclosed: Initial advisory publication by Jenkins Project