What is the CVSS score of CVE-2026-57301?

CVE-2026-57301 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-57301?

Within 24 hours, inventory all Jenkins instances running OWASP ZAP Plugin 1.0.7 or earlier and immediately audit Item/Configure permission assignments to restrict access to essential administrators; review Jenkins audit logs for any unauthorized configuration changes. Within 7 days, establish continuous monitoring of Jenkins audit logs for configuration activities, evaluate whether the OWASP ZAP Plugin is actively required, and contact vendor to confirm patch availability status and timeline. Within 30 days, execute remediation: either upgrade to the patched version immediately upon availability, or if no patch emerges, implement Jenkins controller network isolation, disable this plugin if not essential, and run affected instances in environments segregated from production infrastructure.

Jenkins OWASP ZAP Plugin CVE-2026-57301

EUVD-2026-38782 HIGH

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2026-06-24 jenkins

GHSA-5qh3-hxx9-w26p

Jenkins RCE Jenkins Owasp Zap Plugin

8.8

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable via the Jenkins web UI (AV:N/AC:L) but requires the Item/Configure privilege (PR:L, not PR:N); controller code execution yields total C/I/A impact within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:59 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

HIGH 8.8

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Articles & Coverage 2

News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 25, 2026 News 5 New Jenkins Vulnerabilities - 5 High Severity, No Public Exploits Jun 24, 2026

AnalysisAI

Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).

Technical ContextAI

Jenkins uses a controller/agent architecture in which the controller orchestrates jobs and holds sensitive material (credentials, secrets, the object model), while builds are meant to execute on isolated agents. This flaw is a CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) style controller/agent boundary violation: the plugin performs its build operations directly on the controller JVM rather than dispatching them to the assigned agent. Because controller-side execution runs with full access to Jenkins internals and the filesystem hosting credentials, work that should have been sandboxed on an agent instead crosses into the controller's trust sphere. The affected component is cpe:2.3:a:jenkins_project:jenkins_owasp_zap_plugin, a CI integration plugin that drives OWASP ZAP security scans from Jenkins pipelines/jobs.

RemediationAI

Consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3649 for the fixed release; the provided data confirms 1.0.7 and earlier are vulnerable but does not include an exact fixed version, so the patched version is not independently confirmed from the available data - verify and upgrade to the vendor-designated fixed build. Until patched, restrict the Item/Configure permission to a minimal set of trusted administrators so untrusted users cannot add or modify build steps that invoke the plugin, and consider disabling or uninstalling the OWASP ZAP Plugin if the scan functionality is not essential (trade-off: loss of automated ZAP scanning in affected pipelines). Where the plugin must remain, isolate the controller by limiting what runs on it and auditing job configurations for unexpected ZAP build steps.