CVE-2026-57298: Jenkins Contrast Plugin CSRF Vulnerability

CVE-2026-57298 Overview

CVE-2026-57298 is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier. The flaw allows attackers to coerce Jenkins into connecting to an attacker-specified URL using attacker-controlled credentials, including a username, API key, and service key. Exploitation requires a Jenkins user with valid authentication to visit a malicious page or follow a crafted link. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can redirect Jenkins connections to attacker-controlled endpoints and harvest credentials submitted through the plugin configuration, enabling credential interception and downstream account compromise.

Affected Products

Jenkins Contrast Continuous Application Security Plugin 3.11
Jenkins Contrast Continuous Application Security Plugin prior to 3.11
Jenkins controllers using the affected plugin versions

Discovery Timeline

2026-06-24 - Jenkins publishes security advisory SECURITY-3697
2026-06-24 - CVE-2026-57298 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57298

Vulnerability Analysis

The Jenkins Contrast Continuous Application Security Plugin exposes an HTTP endpoint that performs a connection test to a user-specified URL using credentials supplied in the request. The endpoint lacks CSRF protection, so it accepts state-changing requests without verifying a request token issued by Jenkins. An authenticated victim who loads attacker content in the same browser triggers the request with their session cookies attached.

The attacker controls the destination URL, username, API key, and service key parameters. Jenkins then initiates an outbound HTTP request to the attacker's server, transmitting the supplied credentials in the connection test. The attacker captures these credentials at the receiving endpoint.

The vulnerability is classified as [CWE-352]. Network exploitation is possible because Jenkins is typically reachable over HTTP, and the attack requires no privileges from the attacker beyond the ability to send a victim a link or embed a request on a visited page.

Root Cause

The root cause is missing CSRF token validation on the connection test handler within the Contrast plugin. Jenkins provides a built-in CSRF protection mechanism using crumb tokens, but the affected handler does not require POST submissions or validate the crumb before processing the request.

Attack Vector

An attacker hosts a web page containing an auto-submitting HTML form or image tag that targets the vulnerable Jenkins endpoint. When an authenticated Jenkins user with permission to configure the plugin visits the page, the browser submits the request with the user's session cookies. Jenkins then connects to the attacker's URL and discloses the credentials passed in the request parameters.

No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Jenkins Security Advisory #2026-06-24 for vendor technical details.

Detection Methods for CVE-2026-57298

Indicators of Compromise

Unexpected outbound HTTP connections from the Jenkins controller to external or unfamiliar hosts originating from the Contrast plugin
Jenkins access logs showing GET requests to Contrast plugin connection test endpoints lacking a valid Jenkins-Crumb header or parameter
Referer headers in Jenkins logs pointing to external domains for plugin configuration actions

Detection Strategies

Review Jenkins audit logs for plugin configuration test requests issued from non-Jenkins origins or without CSRF crumbs
Correlate Jenkins outbound network connections with administrator browser sessions to identify CSRF-triggered traffic
Monitor for credential reuse attempts on Contrast TeamServer accounts whose API keys are stored in Jenkins

Monitoring Recommendations

Enable verbose access logging on the Jenkins controller and forward logs to a centralized analytics platform for correlation
Alert on outbound connections from Jenkins to destinations outside an approved allowlist of Contrast TeamServer endpoints
Track plugin installation inventory across Jenkins controllers to confirm patch status of the Contrast plugin

How to Mitigate CVE-2026-57298

Immediate Actions Required

Identify all Jenkins controllers running the Contrast Continuous Application Security Plugin version 3.11 or earlier
Rotate any Contrast TeamServer API keys and service keys that have been configured in affected Jenkins instances
Restrict Jenkins controller administrative access to trusted networks and require fresh authentication for configuration changes

Patch Information

As of the advisory publication date, no fixed version of the Jenkins Contrast Continuous Application Security Plugin has been released. Refer to the Jenkins Security Advisory #2026-06-24 for the current remediation status and any subsequent patch availability.

Workarounds

Disable the Contrast Continuous Application Security Plugin until a patched version is available
Restrict the Overall/Administer and plugin configuration permissions to a minimal set of trusted Jenkins users
Require administrators to use isolated browser profiles or dedicated workstations when accessing Jenkins to reduce CSRF exposure

bash

# List installed plugins and identify the Contrast plugin version on a Jenkins controller
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="contrast-continuous-application-security") | {shortName, version, enabled}'

# Disable the plugin via the Jenkins CLI until a fix is released
java -jar jenkins-cli.jar -s "$JENKINS_URL" -auth "$JENKINS_USER:$JENKINS_TOKEN" \
  disable-plugin contrast-continuous-application-security -restart