EUVD-2026-38778
GHSA-p44q-fmwr-jqr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires only low-privilege Jenkins auth (PR:L); no confidentiality or availability impact, only unauthorized outbound connection initiation (I:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
AnalysisAI
Missing authorization in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier permits any authenticated Jenkins user holding the minimal Overall/Read permission to invoke a connection test endpoint with fully attacker-controlled URL, username, API key, and service key. This enables the Jenkins server to make arbitrary outbound HTTP connections - a Server-Side Request Forgery (SSRF)-class impact - without the elevated privileges that should guard such functionality. No public exploit has been identified at time of analysis and EPSS sits at the 4th percentile, indicating low current exploitation probability despite network reachability.
Technical ContextAI
CWE-862 (Missing Authorization) manifests here as a failure to enforce adequate permission checks on an internal Jenkins plugin action - almost certainly a form-validation or 'Test Connection' HTTP endpoint exposed by the Contrast plugin's configuration UI. Jenkins plugins routinely expose such endpoints and are expected to gate them on permissions commensurate with the action (typically Overall/Administer or Item/Configure). The affected product is identified by CPE cpe:2.3:a:jenkins_project:jenkins_contrast_continuous_application_security_plugin:*:*:*:*:*:*:*:* covering all versions through 3.11. The Contrast Continuous Application Security Plugin integrates Jenkins with Contrast Security's SAST/IAST platform, meaning its connection endpoints carry authentication material (API keys, service keys) that can be directed arbitrarily by the caller.
RemediationAI
Patch available per vendor advisory - consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1) for the specific patched plugin version and update the plugin via Jenkins Plugin Manager. An exact fixed version number was not provided in the available intelligence data and should be confirmed directly from the advisory before upgrading. As a compensating control while patching is in progress, restrict Overall/Read access to only fully trusted users, since that is the sole prerequisite for exploitation; this has the side effect of limiting general Jenkins visibility for lower-trust users. Alternatively, temporarily disable or uninstall the Contrast Continuous Application Security Plugin if the Contrast integration is not actively in use, eliminating the vulnerable endpoint entirely with no operational impact to unrelated Jenkins functionality.
Cross-site request forgery in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows a remote a
Missing authorization checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow any authe
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today