Executive brief
The Jenkins OWASP ZAP Plugin, which integrates security scanning into automated build processes, contains a vulnerability that incorrectly executes tasks on the central Jenkins controller instead of isolated worker machines. This allows users with permission to configure build jobs to execute unauthorized code directly on the primary management server. Such an exploit could lead to full system compromise, data theft, or disruption of the entire CI/CD pipeline.
Technical details
The Jenkins OWASP ZAP Plugin (versions 1.0.7 and earlier) fails to properly distribute build workloads to designated Jenkins agents. Instead, it performs build operations directly on the Jenkins controller. An attacker with 'Item/Configure' permissions can exploit this behavior to execute arbitrary code in the context of the Jenkins controller process. This bypasses the intended security isolation between the controller and agents. As of the advisory date, users are advised to check for plugin updates from the Jenkins project to remediate this controller-side execution vulnerability.
Affected products
- Jenkins Project OWASP ZAP Plugin 1.0.7 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory