CVE-2026-57299: Jenkins Contrast Continuous Application Security Plugin missing permission check

CVE-2026-57299 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software build process, contains a flaw in how it handles user permissions. This vulnerability allows any user with basic read access to the Jenkins dashboard to see the names of configured security metadata that should otherwise be restricted. While this does not allow for direct system takeover, it exposes internal configuration details that could be used to plan further attacks.

Technologies: Jenkins Project Contrast Continuous Application Security Plugin, org.jenkins-ci.plugins:contrast-continuous-application-security (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57299 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57299 being exploited in the wild.
How severe is CVE-2026-57299?
Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier; org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) < 3.12, ECOSYSTEM:introduced=0,fixed=3.12.
Is there a fix for CVE-2026-57299?
Yes. org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57299 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57299?
Check whether you run Jenkins Project Contrast Continuous Application Security Plugin or org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:contrast-continuous-application-security (Maven): upgrade to 3.12 or later
    # set org.jenkins-ci.plugins:contrast-continuous-application-security to 3.12 in your pom.xml or build.gradle

Technical details

The Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier fails to perform adequate permission checks on an HTTP endpoint. This allows an attacker with Overall/Read permission to enumerate the names of configured Contrast metadata. The vulnerability is a result of missing authorization logic in the component responsible for exposing metadata configuration. This is categorized as a missing permission check (CWE-862). Users should update to a version later than 3.11 if available or restrict Overall/Read access to trusted individuals.

Affected products

  • Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier

Identifiers

  • CVE-2026-57299
  • GHSA-8263-qv4g-vfxr

Timeline

  • 2026-06-24: advisory: Initial advisory publication by Jenkins Project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.