Jenkins Zowe zDevOps Plugin CVE-2026-57307

Exploitation requires the attacker to hold an active Jenkins account with at least Overall/Read permission; unauthenticated or anonymous access is insufficient. Beyond authentication, CVSS AC:H reflects a hard prerequisite: the attacker must independently obtain valid Jenkins credential IDs through a separate channel - such as a pipeline log leak, another vulnerability, or insider knowledge - before this endpoint can be abused. The Jenkins Zowe zDevOps Plugin must be installed and enabled on the target instance; the vulnerability does not exist in Jenkins core. Exploitation is further constrained to credential types usable in Zowe connection tests. The attack is rated non-automatable by SSVC, meaning opportunistic mass scanning is not a realistic threat vector. Organizations that enforce least-privilege Jenkins access or that have not deployed the zDevOps plugin face no realistic exposure.

The CVSS 3.1 score of 4.2 (Medium) reflects the network-accessible attack vector offset by High complexity (AC:H) and Low privilege requirement (PR:L), with only partial confidentiality and integrity impact and no availability impact. AC:H is well-justified here: the attacker must first independently enumerate or obtain valid Jenkins credential IDs via a separate method before this vulnerability can be weaponized, making the attack a two-stage operation rather than a single-step exploit. EPSS at 0.13% (3rd percentile) confirms negligible exploitation interest from the broader threat landscape. SSVC corroborates this: exploitation status is none, the attack is not automatable, and technical impact is only partial. The vulnerability is absent from CISA KEV. Taken together, the signals consistently depict a real but lower-priority finding - particularly in environments where Jenkins access is already gated to trusted internal users. The primary real-world concern is insider threat or privilege escalation within a Jenkins instance where the zDevOps plugin is deployed and credential segregation is assumed.

An insider or low-privilege Jenkins user first enumerates credential IDs stored in Jenkins via a separate information-disclosure path - for example, a misconfigured pipeline log or another missing-permission endpoint. The attacker then directly calls the unprotected zDevOps plugin endpoint, supplying a URL pointing to an attacker-controlled server and the harvested credential IDs, causing Jenkins to authenticate against that server and expose the stored secrets. No public proof-of-concept code has been identified at time of analysis.