Is CVE-2026-57301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57301 being exploited in the wild.

How severe is CVE-2026-57301?

High severity, with a CVSS score of 8.8, published 24 June 2026.

Which products and versions are affected?

Jenkins Project OWASP ZAP Plugin 1.0.7 and earlier; org.jenkins-ci.plugins:zapper (Maven) <= 1.0.7, ECOSYSTEM:introduced=0,last_affected=1.0.7.

Is there a fix for CVE-2026-57301?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57301 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57301?

Check whether you run Jenkins Project OWASP ZAP Plugin or org.jenkins-ci.plugins:zapper (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57301: Jenkins OWASP ZAP Plugin arbitrary code execution on controller

Q: Is there a fix for CVE-2026-57301?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-57301 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57301?

Check whether you run Jenkins Project OWASP ZAP Plugin or org.jenkins-ci.plugins:zapper (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57301 · Severity: high · CVSS 8.8 · Published 2026-06-24

The Jenkins OWASP ZAP Plugin, which integrates security scanning into automated build processes, contains a vulnerability that incorrectly executes tasks on the central Jenkins controller instead of isolated worker machines. This allows users with permission to configure build jobs to execute unauthorized code directly on the primary management server. Such an exploit could lead to full system compromise, data theft, or disruption of the entire CI/CD pipeline.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57301 being exploited in the wild.
How severe is CVE-2026-57301?: High severity, with a CVSS score of 8.8, published 24 June 2026.
Which products and versions are affected?: Jenkins Project OWASP ZAP Plugin 1.0.7 and earlier; org.jenkins-ci.plugins:zapper (Maven) <= 1.0.7, ECOSYSTEM:introduced=0,last_affected=1.0.7.
Is there a fix for CVE-2026-57301?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57301 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57301?: Check whether you run Jenkins Project OWASP ZAP Plugin or org.jenkins-ci.plugins:zapper (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Jenkins OWASP ZAP Plugin (versions 1.0.7 and earlier) fails to properly distribute build workloads to designated Jenkins agents. Instead, it performs build operations directly on the Jenkins controller. An attacker with 'Item/Configure' permissions can exploit this behavior to execute arbitrary code in the context of the Jenkins controller process. This bypasses the intended security isolation between the controller and agents. As of the advisory date, users are advised to check for plugin updates from the Jenkins project to remediate this controller-side execution vulnerability.

Affected products

Jenkins Project OWASP ZAP Plugin 1.0.7 and earlier

Identifiers

CVE-2026-57301
GHSA-5qh3-hxx9-w26p

Timeline

2026-06-24: disclosed
2026-06-24: advisory

References

https://www.jenkins.io/security/advisory/2026-06-24/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.