Contrast Security Plugin EUVD-2026-38779

The victim must be an authenticated Jenkins user (any role that has permission to access or trigger the Contrast plugin configuration endpoint) and must visit an attacker-controlled page while their Jenkins session is active in the same browser. The Jenkins instance must have the Contrast Continuous Application Security Plugin version 3.11 or earlier installed and active. No special network position is required for the attacker beyond being able to serve a web page to the victim. Exploitation is limited by the requirement for victim interaction - the attack cannot be performed without the user visiting the malicious page - and by the need for the victim to hold an active, valid Jenkins session at the time of the forged request.

The NVD CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N scores 5.4 Medium. However, the PR:L/UI:N combination is atypical for a CSRF: CSRF attacks require the victim to be an authenticated user who visits an attacker-controlled page, which normally maps to PR:N (attacker has no privileges) and UI:R (victim interaction is essential). The provided vector omits the user-interaction requirement - this inconsistency should be verified with the Jenkins security team. SSVC signals reinforce a lower prioritisation: exploitation is rated 'none', automation is rated 'no' (social engineering of a Jenkins user is required), and technical impact is only partial. EPSS data is not provided. The vulnerability is not listed in CISA KEV, and no POC is publicly available. Real-world risk is moderate: the primary danger is server-side request forgery (SSRF-lite), where Jenkins can be redirected to reach internal network endpoints under attacker-controlled credentials, potentially leaking whether those endpoints exist or accepting crafted Contrast API responses.

An attacker identifies a Jenkins instance using the Contrast plugin and social-engineers a logged-in Jenkins user into visiting a malicious web page. That page silently submits a forged POST request to the Jenkins Contrast plugin configuration endpoint, substituting the Contrast service URL and credentials with attacker-controlled values. Jenkins then attempts to connect to the attacker's server, potentially exposing internal network topology or accepting a malicious Contrast API response.