Jenkins External Workspace Manager Plugin CVE-2026-57296

Exploitation requires the attacker to hold Jenkins Item/Configure permission, allowing them to define or modify a Pipeline that invokes the exwsAllocate step, and to supply a malicious custom workspace path containing path traversal sequences - this is an authenticated attack, not unauthenticated. The plugin must be installed and at version 1.3.2 or earlier. The limiting factor is the Item/Configure privilege gate: users without job-configuration rights cannot reach the vulnerable step, so realistic risk is highest in environments where configure access is broadly delegated to developers. No user interaction by a victim and no non-default plugin configuration is required beyond having the plugin installed and the step in use.

Signals are moderately consistent toward a real but gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, base 8.8 High) indicates network-reachable, low-complexity exploitation with no user interaction, but critically requires PR:L - the attacker must already hold Item/Configure permission, which limits exploitation to users trusted enough to define or edit pipeline jobs. CISA SSVC supports a non-urgent posture: Exploitation=none, Automatable=no, Technical Impact=total - meaning maximum damage if exploited but no observed exploitation and no straightforward mass-automation. There is no KEV listing and no POC identified, so this is not an active-exploitation emergency. The primary risk amplifier is the privilege threshold: in many Jenkins deployments Item/Configure is granted fairly broadly to developers, so an insider or a compromised developer account converts this into controller file read and plausibly RCE. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here.

A developer with Item/Configure permission (or an attacker who has phished such an account) edits or creates a Pipeline job that calls exwsAllocate with a custom workspace path containing '../../' sequences pointing at sensitive controller files such as credentials.xml or the master key. When the pipeline runs, the plugin resolves the traversal and reads those files back, which the attacker can then use to recover credentials and pivot to remote code execution on the controller. No public POC is identified at this time, and the low attack complexity means exploitation is straightforward once configure access is held.