Zowe zDevOps Plugin CVE-2026-57306

Four specific conditions must be satisfied simultaneously. First, the victim must be authenticated to Jenkins with at least low-level privileges (PR:L per CVSS). Second, the Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 or earlier must be installed and active on the target Jenkins controller. Third - and critically limiting - the attacker must have already obtained one or more valid Jenkins credential IDs through a separate, independent method prior to the CSRF attack; the CSRF alone does not reveal credential IDs. Fourth, attack complexity is rated High (AC:H), indicating that specific, non-generic conditions beyond a basic network position must align. Limiting factors include: the requirement for pre-obtained credential IDs narrows the viable attacker pool substantially; the plugin is specific to IBM z/OS mainframe DevOps environments, limiting the exposed population; and if the Jenkins instance enforces CSRF protection globally at the controller level, the per-plugin gap may be partially mitigated depending on implementation.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) scores 4.2 Medium. The AC:H metric is meaningful here: the attacker must independently obtain valid Jenkins credential IDs before the CSRF vector has any utility, significantly narrowing the realistic attacker pool. EPSS at 0.09% and 0th percentile confirms near-zero observed exploitation interest. SSVC classification of Exploitation:none, Automatable:no, Technical Impact:partial is consistent with a constrained, multi-step attack path rather than a spray-and-pray threat. The vulnerability is not in CISA KEV. One notable signal mismatch: the supplied CVSS vector specifies UI:N, but CSRF by definition requires the victim to load attacker-influenced content to trigger the forged request - independent assessment rates this UI:R. This discrepancy reduces the actual severity slightly below the stated score. For Jenkins administrators running this plugin in mainframe environments, risk is real but low-priority; the primary impact is potential credential exfiltration from Jenkins's credential store, which could be high-value in pipeline contexts despite the modest CVSS score.

An attacker who has separately enumerated Jenkins credential IDs (for example, via a misconfigured Jenkins API or another information disclosure) crafts a malicious web page containing a forged HTTP request targeting the zDevOps Plugin's connection endpoint. When an authenticated Jenkins user with at least low-level access visits this page, the browser automatically submits the request, causing Jenkins to initiate an outbound connection to the attacker's server using the specified credentials, effectively handing the attacker the credential material. No public proof-of-concept code has been identified at the time of this analysis.