Contrast Security Plugin EUVD-2026-38780

The attacker must be authenticated to the Jenkins instance with at minimum Overall/Read permission - the baseline access level for virtually any registered Jenkins user. The Jenkins Contrast Continuous Application Security Plugin must be installed and have at least one Contrast metadata entry configured. No non-default configuration, no elevated privilege, and no user interaction are required beyond this baseline. Exploitation is strictly limited to users with valid Jenkins credentials (PR:L per CVSS), preventing unauthenticated external access. Impact is confined to read-only enumeration of metadata names; no credential theft, code execution, or configuration modification is possible through this vector. Environments where all Jenkins users are fully trusted employees face minimal realistic risk.

The provided CVSS 4.3 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N contains a notable inconsistency: the described impact - enumerating configured metadata names - is a confidentiality concern (C:L), not an integrity concern (I:L); defenders should verify the vector against the vendor advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(2) before relying on it for risk scoring. EPSS at 0.15% (4th percentile) strongly suggests this is not being exploited opportunistically. No KEV listing and no public POC exist. Practically, this is a reconnaissance-class issue: an insider or low-privilege Jenkins user could map Contrast metadata names to gain insight into the security tooling configuration, but cannot extract credentials, execute code, or escalate privileges through this vector alone. Priority is low in environments with trusted Jenkins user populations and elevated for shared Jenkins instances where untrusted users hold Overall/Read access.

An authenticated Jenkins user holding only the default Overall/Read permission sends a crafted HTTP request to the Contrast plugin's metadata enumeration endpoint. Because no additional permission check is enforced, the plugin returns the names of all configured Contrast metadata entries. The attacker uses these names to understand the security tooling configuration, potentially identifying named credentials or scan targets for subsequent lateral movement or targeted tampering.