CVE-2026-57306: Jenkins Zowe zDevOps Plugin CSRF in credential connection endpoint

CVE-2026-57306 · Severity: medium · CVSS 4.2 · Published 2026-06-24

The Jenkins Zowe zDevOps Plugin, which integrates Jenkins with Zowe for mainframe DevOps, contains a security flaw that could allow an attacker to steal stored credentials. By tricking a logged-in user into clicking a malicious link, an attacker can force the plugin to connect to a server they control. This allows the attacker to capture sensitive login information stored within Jenkins, potentially leading to unauthorized access to other systems.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57306 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57306 being exploited in the wild.
How severe is CVE-2026-57306?
Medium severity, with a CVSS score of 4.2, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier; io.jenkins.plugins:zdevops (Maven) <= 1.1.3.50.ve350c9b, ECOSYSTEM:introduced=0,last_affected=1.1.3.50.ve350c9b.
Is there a fix for CVE-2026-57306?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57306 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57306?
Check whether you run Jenkins Project Zowe zDevOps Plugin or io.jenkins.plugins:zdevops (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier. The vulnerability allows an attacker to force a victim's browser to send a request to a specific HTTP endpoint that initiates a connection to an arbitrary URL. By specifying an attacker-controlled URL and providing credential IDs (which must be obtained through separate means), the attacker can capture the credentials stored in Jenkins as the plugin attempts to authenticate against the malicious server. As of the advisory date, no patch has been explicitly detailed in the provided text, though the vulnerability is identified as SECURITY-3747.

Affected products

  • Jenkins Project Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier

Identifiers

  • CVE-2026-57306
  • GHSA-43m2-hcmm-qpm7

Timeline

  • 2026-06-24: disclosed: Advisory published by Jenkins Project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.