CVE-2026-57301: Jenkins OWASP ZAP Plugin RCE Vulnerability

CVE-2026-57301 Overview

CVE-2026-57301 affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier. The plugin performs build operations on the Jenkins controller instead of the assigned build agent. Attackers with Item/Configure permission can leverage this behavior to execute arbitrary code directly on the Jenkins controller. The flaw is classified under CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). Successful exploitation grants attackers full access to controller-side secrets, credentials, and configuration data managed by Jenkins.

Critical Impact
Authenticated attackers with job configuration rights can execute arbitrary code on the Jenkins controller, compromising the entire CI/CD pipeline.

Affected Products

Jenkins OWASP ZAP Plugin 1.0.7
Jenkins OWASP ZAP Plugin versions prior to 1.0.7
Jenkins controllers running the affected plugin

Discovery Timeline

2026-06-24 - Jenkins publishes Security Advisory SECURITY-3649
2026-06-24 - CVE-2026-57301 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-57301

Vulnerability Analysis

The Jenkins OWASP ZAP Plugin integrates the OWASP Zed Attack Proxy into Jenkins build pipelines for automated dynamic application security testing. In secure Jenkins deployments, plugins must execute build steps on assigned build agents to maintain the controller/agent security boundary. The OWASP ZAP Plugin violates this boundary by running build operations on the Jenkins controller itself.

This architecture flaw allows any user with Item/Configure permission to define ZAP build steps that execute in the controller's JVM context. Attackers gain access to controller-side resources including the secret store, encryption keys, agent credentials, and the ability to manipulate other jobs. The vulnerability falls under the broader category of broken access control and confused deputy patterns referenced by [CWE-610].

Root Cause

The plugin code paths invoke build logic without dispatching the work to the assigned agent's Launcher and FilePath channels. Instead, file operations and process invocations run in the controller process. Jenkins controllers hold privileged trust, and plugins are expected to delegate untrusted work to agents.

Attack Vector

An authenticated user configures a Jenkins job that invokes the OWASP ZAP Plugin. When the job runs, the plugin's controller-side execution context allows the attacker to read sensitive controller files, exfiltrate credentials, or pivot to other Jenkins resources. The attack requires network access to the Jenkins web interface and Item/Configure permission on at least one job.

No verified proof-of-concept code is publicly available. See the Jenkins Security Advisory SECURITY-3649 for vendor technical details.

Detection Methods for CVE-2026-57301

Indicators of Compromise

Unexpected processes spawned by the Jenkins controller JVM linked to ZAP scan execution
Access to controller-side files such as secrets/ or credentials.xml from job execution contexts
Anomalous outbound network connections originating from the Jenkins controller host rather than build agents
Job configuration changes adding ZAP build steps by users with only Item/Configure permission

Detection Strategies

Inventory Jenkins plugins and flag any instance of OWASP ZAP Plugin at version 1.0.7 or earlier
Monitor Jenkins audit logs for job configuration events introducing ZAP build steps
Correlate Jenkins controller process activity with build execution to identify work that should run on agents
Review Jenkins user permission assignments for accounts with Item/Configure rights

Monitoring Recommendations

Forward Jenkins controller audit logs and system logs to a centralized SIEM for behavioral analysis
Alert on file access by the Jenkins controller JVM to secret stores during job execution windows
Track plugin version inventory through automated configuration management scans
Monitor for credential use originating from the Jenkins controller host outside expected administrative windows

How to Mitigate CVE-2026-57301

Immediate Actions Required

Identify all Jenkins instances running OWASP ZAP Plugin 1.0.7 or earlier through the Jenkins plugin manager
Restrict Item/Configure permission to trusted administrators until a fixed release is deployed
Audit existing jobs that use the OWASP ZAP Plugin and validate their configurations
Rotate credentials stored on affected Jenkins controllers if exploitation is suspected

Patch Information

As of publication, the Jenkins security team has issued advisory SECURITY-3649 covering this issue. Review the Jenkins Security Advisory SECURITY-3649 for the current fix status and upgrade guidance. Apply the vendor-provided update as soon as it becomes available.

Workarounds

Disable the OWASP ZAP Plugin until a patched version is installed
Remove Item/Configure permission from non-administrative users on affected controllers
Run Jenkins controllers with the principle of least privilege and isolate them from build workloads
Use access control lists to restrict network reach from the Jenkins controller to sensitive internal resources

bash

# Configuration example - disable the plugin via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  disable-plugin zap-pipeline -restart