EUVD-2026-38788
GHSA-xx59-jv36-5r44
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network endpoint requires low-privilege Jenkins authentication; AC:H reflects mandatory prerequisite of independently obtained credential IDs; no availability impact applies.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
AnalysisAI
Missing authorization in Jenkins Zowe zDevOps Plugin (≤1.1.3.50.ve350c9b_450b_1) allows an authenticated low-privilege user holding only Overall/Read permission to invoke an unprotected plugin endpoint, supplying attacker-controlled connection parameters and externally obtained credential IDs to capture secrets stored in the Jenkins credential store. The Jenkins project confirmed the flaw under SECURITY-3747 and published an advisory on 2026-06-24. No public exploit code or active exploitation has been identified; EPSS places this at the 3rd percentile and SSVC rates exploitation as none with non-automatable attack mechanics.
Technical ContextAI
Jenkins exposes plugin functionality via its Stapler web framework, where HTTP-bound methods must be explicitly annotated with permission checks to prevent unauthorized invocation. CWE-862 (Missing Authorization) identifies the root cause: the zDevOps plugin exposes a credential-connection-test action without verifying that the caller holds privileges beyond the baseline Overall/Read level. The Zowe zDevOps Plugin provides IBM z/OS pipeline integration via Zowe APIs, handling mainframe credentials within the Jenkins credential store. The affected component is solely the plugin, identified by CPE cpe:2.3:a:jenkins_project:jenkins_zowe_zdevops_plugin:*:*:*:*:*:*:*:*, not Jenkins core itself. Because the action accepts caller-supplied credential IDs and a target URL, an attacker can redirect Jenkins into transmitting those credentials to an external server under their control.
RemediationAI
Administrators should consult the Jenkins project security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3747 and upgrade the Jenkins Zowe zDevOps Plugin to the version released after 1.1.3.50.ve350c9b_450b_1; no specific fixed version number was present in the input data, so the advisory should be checked for the exact remediated release. If an immediate upgrade is not possible, restrict Overall/Read permission to only verified, trusted Jenkins users, since exploitation requires at minimum that permission level - removing anonymous or broadly granted read access raises the bar for abuse. For Jenkins instances that do not actively use Zowe or z/OS integration, uninstalling the zDevOps plugin entirely eliminates the attack surface without affecting unrelated pipelines. Segmenting credential IDs so that Zowe-related credentials are only visible to pipelines that genuinely require them limits the blast radius of any successful credential-capture attempt.
More in Jenkins Zowe Zdevops Plugin
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today