EUVD-2026-38782
GHSA-5qh3-hxx9-w26p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins with Item/Configure rights
-
DeliveryConfigure job to use OWASP ZAP build step
-
ExploitPlugin executes step on controller not agent
-
ExecutionRun arbitrary code in controller JVM
-
ImpactAccess credentials and compromise controller
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires an authenticated Jenkins user with the Item/Configure permission (PR:L) on the network-reachable Jenkins UI, and the OWASP ZAP Plugin (≤1.0.7) must be installed and used in a build step. The specific trigger is that the plugin's build operations execute on the Jenkins controller instead of the assigned agent, so an attacker who can configure a job to invoke that build step gains code execution on the controller. Limiting factors: this is not remote-unauthenticated - it requires the configure privilege, which in hardened deployments is restricted to trusted administrators; no user interaction is needed once the attacker has that permission (UI:N), and no non-default configuration beyond having the plugin installed is required. |
| Impact | The signals are internally consistent and point to a genuine but access-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, 8.8 High) shows network reachability, low complexity, no user interaction, and total impact - matching CISA SSVC's 'Technical Impact: total'. The key limiter is PR:L: the attacker must already hold Item/Configure permission, i.e. an authenticated user trusted to configure jobs, which is why SSVC marks 'Automatable: no' and 'Exploitation: none'. EPSS is low (0.39%), consistent with an insider/privilege-abuse class of bug rather than mass internet exploitation. This is a real prioritization item for organizations that delegate job-configuration rights broadly, but lower urgency where Item/Configure is tightly restricted to trusted admins. No conflicts detected between the CVSS vector and the description; both agree exploitation requires authenticated configure-level access. |
| Exploit ScenarioDerived | A developer or contractor granted Item/Configure rights edits an existing job (or creates one) that uses the OWASP ZAP Plugin build step; because the plugin executes on the controller rather than the assigned agent, the configured operation runs code directly in the controller JVM. The attacker uses this to read Jenkins credentials or execute OS commands on the controller host. No public proof-of-concept is identified at time of analysis, and exploitation requires the network-accessible Jenkins UI plus valid configure-level access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).
RemediationAI
Consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3649 for the fixed release; the provided data confirms 1.0.7 and earlier are vulnerable but does not include an exact fixed version, so the patched version is not independently confirmed from the available data - verify and upgrade to the vendor-designated fixed build. Until patched, restrict the Item/Configure permission to a minimal set of trusted administrators so untrusted users cannot add or modify build steps that invoke the plugin, and consider disabling or uninstalling the OWASP ZAP Plugin if the scan functionality is not essential (trade-off: loss of automated ZAP scanning in affected pipelines). Where the plugin must remain, isolate the controller by limiting what runs on it and auditing job configurations for unexpected ZAP build steps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins uses a controller/agent architecture in which the controller orchestrates jobs and holds sensitive material (credentials, secrets, the object model), while builds are meant to execute on isolated agents. This flaw is a CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) style controller/agent boundary violation: the plugin performs its build operations directly on the controller JVM rather than dispatching them to the assigned agent. Because controller-side execution runs with full access to Jenkins internals and the filesystem hosting credentials, work that should have been sandboxed on an agent instead crosses into the controller's trust sphere. The affected component is cpe:2.3:a:jenkins_project:jenkins_owasp_zap_plugin, a CI integration plugin that drives OWASP ZAP security scans from Jenkins pipelines/jobs.
Know when Jenkins Owasp Zap Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reachable via the Jenkins web UI (AV:N/AC:L) but requires the Item/Configure privilege (PR:L, not PR:N); controller code execution yields total C/I/A impact within an unchanged scope.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
Articles & Coverage 2
Executive ViewAI
Jenkins OWASP ZAP Plugin versions through 1.0.7 permits users holding Item/Configure permission to execute arbitrary code on Jenkins controllers, potentially compromising the entire CI/CD pipeline and enabling lateral movement to production systems. This vulnerability exploits improper task execution on controllers instead of isolated agents, creating significant insider risk. Immediate access restriction to configuration rights and planned remediation are essential to prevent build infrastructure compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict Item/Configure permissions to trusted administrators only; disable OWASP ZAP Plugin if not actively required; implement Jenkins controller network isolation and firewall controls; enable and monitor Jenkins audit logs for suspicious configuration changes; run affected Jenkins controllers in isolated network segments separate from production infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB