What is the CVSS score of CVE-2026-57306?

CVE-2026-57306 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Zowe zDevOps Plugin CVE-2026-57306

EUVD-2026-38787 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-24 jenkins

GHSA-43m2-hcmm-qpm7

CSRF Jenkins Jenkins Zowe Zdevops Plugin Jenkins Project

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.7 LOW

CSRF requires the victim to load attacker content (UI:R); pre-obtained credential IDs and multi-step setup justify AC:H; PR:L reflects authenticated-victim requirement.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:57 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

AnalysisAI

Cross-site request forgery in Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier enables network-based attackers to force authenticated Jenkins users into making unauthorized outbound HTTP connections to attacker-controlled infrastructure, using credential IDs the attacker obtained through a separate method to capture secrets stored in Jenkins. The attack requires high complexity - specifically, the attacker must pre-obtain valid Jenkins credential IDs via an independent channel before the CSRF vector becomes useful. No public exploit code exists and no active exploitation is confirmed; EPSS stands at 0.09% (0th percentile), reflecting negligible observed exploitation interest.

Technical ContextAI

Jenkins Zowe zDevOps Plugin provides CI/CD integration with IBM z/OS mainframe DevOps workflows via the Zowe framework. The plugin exposes endpoints that perform HTTP connections using Jenkins-stored credential objects; these endpoints lack CSRF protection tokens (CWE-352), meaning any page under attacker control can silently submit forged requests on behalf of a logged-in Jenkins user. The CPE string cpe:2.3:a:jenkins_project:jenkins_zowe_zdevops_plugin:*:*:*:*:*:*:*:* covers all versions up to and including 1.1.3.50.ve350c9b_450b_1. CWE-352 (Cross-Site Request Forgery) indicates the root cause is missing or bypassable state-validation on sensitive plugin actions, a class of flaw Jenkins's security framework addresses via Stapler/Crumb tokens that this plugin version failed to enforce properly.

RemediationAI

Upgrade the Jenkins Zowe zDevOps Plugin per the vendor advisory published at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3747. The exact patched version is not independently confirmed from available input data - administrators should consult the advisory directly to identify the minimum safe release. As a compensating control pending upgrade, restrict Jenkins access so that only trusted users hold any permissions on the zDevOps Plugin's configuration or connection-test actions, reducing the risk that a logged-in victim is socially engineered into triggering the CSRF. Additionally, enforcing strict Content Security Policy headers on the Jenkins instance and ensuring the Jenkins Crumb Issuer is enabled globally (Jenkins > Manage Jenkins > Configure Global Security > CSRF Protection) may provide partial mitigation, though plugin-level enforcement is the definitive fix. Disabling the plugin entirely eliminates the attack surface with the trade-off of losing Zowe mainframe integration.