Jenkins Contrast Plugin CVE-2026-57297

Exploitation requires a valid Jenkins account with at minimum Overall/Read permission - the baseline permission granted to almost all authenticated Jenkins users in most deployments. The Jenkins Contrast Continuous Application Security Plugin version 3.11 or earlier must be installed and active on the target Jenkins instance. No special plugin configuration, job setup, or elevated role beyond Overall/Read is required. Limiting factors: unauthenticated access is not possible (PR:L per CVSS vector); attackers without any Jenkins account cannot exploit this remotely. The impact is constrained to outbound connection initiation from the Jenkins server - no direct code execution, data exfiltration from Jenkins, or availability disruption results from this flaw alone.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the bounded impact: exploitation is network-accessible and requires no special configuration complexity, but does require a valid Jenkins account with at least Overall/Read - the lowest meaningful Jenkins permission tier. Confidentiality and availability impacts are both absent from the CVSS vector, limiting real-world damage to unauthorized outbound connections (integrity impact only). EPSS at 0.15% (4th percentile) confirms that exploitation in the wild is currently rare or unobserved. The vulnerability is not listed in CISA KEV, and no POC code has been reported. The primary real-world risk is SSRF: an insider or low-privilege attacker could use Jenkins as a pivot to probe internal services or exfiltrate internal network topology. This is a genuine but moderate priority - organizations with untrusted users holding Overall/Read should treat it as a prompt-to-patch item rather than an emergency.

An authenticated Jenkins user with only Overall/Read permission crafts a request to the Contrast plugin's connection-test form action, substituting an attacker-controlled server address for the legitimate Contrast platform URL along with arbitrary credential values. Jenkins executes the outbound connection on behalf of the attacker, allowing them to confirm internal network reachability of target hosts, harvest timing information about internal services, or receive the supplied API/service key material at their server.