Executive brief
The Jenkins Contrast Continuous Application Security Plugin, which integrates security testing into the software build process, contains a flaw in how it handles user permissions. This vulnerability allows any user with basic read access to the Jenkins dashboard to see the names of configured security metadata that should otherwise be restricted. While this does not allow for direct system takeover, it exposes internal configuration details that could be used to plan further attacks.
Technical details
The Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier fails to perform adequate permission checks on an HTTP endpoint. This allows an attacker with Overall/Read permission to enumerate the names of configured Contrast metadata. The vulnerability is a result of missing authorization logic in the component responsible for exposing metadata configuration. This is categorized as a missing permission check (CWE-862). Users should update to a version later than 3.11 if available or restrict Overall/Read access to trusted individuals.
Affected products
- Jenkins Project Contrast Continuous Application Security Plugin 3.11 and earlier
Timeline
- 2026-06-24: advisory: Initial advisory publication by Jenkins Project