EUVD-2026-38779
GHSA-6qc4-57v3-28rr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CSRF requires no attacker privileges (PR:N) but mandates victim browser interaction (UI:R); limited credential/connection control yields C:L/I:L with no availability impact.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
AnalysisAI
Cross-site request forgery in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows a remote attacker to force a Jenkins instance to establish outbound connections to an arbitrary attacker-controlled URL, supplying attacker-chosen credentials including a username, API key, and service key. Any authenticated Jenkins user can be the unwitting victim if tricked into visiting a crafted page while logged in. No public exploit code or confirmed active exploitation has been identified at time of analysis, and SSVC rates exploitation likelihood as none with partial technical impact.
Technical ContextAI
The Jenkins Contrast Continuous Application Security Plugin integrates Jenkins CI/CD pipelines with Contrast Security's application security testing platform. It stores connection parameters - URL, username, API key, and service key - and uses them to communicate with the Contrast service. CWE-352 (Cross-Site Request Forgery) indicates the plugin's configuration or connection-trigger endpoints lack anti-CSRF token validation, meaning the Jenkins HTTP endpoint can be invoked by a forged cross-origin browser request. The affected CPE is cpe:2.3:a:jenkins_project:jenkins_contrast_continuous_application_security_plugin:*:*:*:*:*:*:*:*, covering all versions up to and including 3.11. Because Jenkins itself enforces a CSRF protection framework (crumbs), plugin endpoints that bypass or omit this check represent a gap in that defence.
RemediationAI
Upgrade the Contrast Continuous Application Security Plugin to a version higher than 3.11 as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1). The advisory does not specify an exact fixed release version in the provided intelligence - affected organisations should check the Jenkins Plugin Manager or the Jenkins Update Center for the latest available release and confirm it addresses SECURITY-3697. If an immediate upgrade is not possible, restrict access to Jenkins configuration pages so that only highly trusted administrators can modify plugin settings, reducing the pool of users whose sessions could be exploited. Additionally, enforcing Jenkins's built-in CSRF protection globally (enabled by default in modern Jenkins LTS) and ensuring users do not browse untrusted sites while authenticated to Jenkins are practical interim compensating controls, though neither eliminates the underlying flaw.
Missing authorization checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow any authe
Missing authorization in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier permits any authentica
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today