Jenkins Owasp Zap Plugin
Monthly
Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).
Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).