CVE-2026-57301: Jenkins OWASP ZAP Plugin Remote Code Execution on Controller

Technical summary

CVE-2026-57301 is a privilege escalation and remote code execution vulnerability in the Jenkins OWASP ZAP Plugin (version 1.0.7 and earlier) caused by improper build execution context handling. The vulnerability stems from CWE-610 (Insufficient Control of Externally Supplied Input), where the plugin fails to enforce execution on designated agent nodes and instead runs build operations on the Jenkins controller. An authenticated attacker with Item/Configure permission can craft a malicious job configuration to execute arbitrary code in the controller's security context. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network accessibility, low complexity, required low-level privileges, and high impact to confidentiality, integrity, and availability.

Business impact

A successful exploit allows attackers to compromise the Jenkins controller, which serves as the nerve center of your CI/CD pipeline. This enables theft of stored credentials, secrets, and API tokens; injection of malicious code into build artifacts and deployments; disruption of all downstream builds and deployments; and lateral movement into connected systems and repositories. The blast radius extends beyond Jenkins itself to any system that consumes its outputs or trusts its authentication.

Affected systems

Jenkins installations using the OWASP ZAP Plugin version 1.0.7 or earlier are affected. The vulnerability requires the attacker to have Item/Configure permission, meaning it affects environments where plugin access controls are loose or where internal threat models assume low-privilege job authors. Organizations running Jenkins for security scanning, code analysis, or automated testing pipelines are prime targets.

Exploitability

Exploitability is practical and does not require sophisticated techniques. The attack vector is network-accessible, requires no special conditions, and needs only basic-level authentication (Item/Configure permission, typically granted to developers or CI/CD engineers). No user interaction is required. However, the attacker must already have Jenkins access and sufficient permissions, which narrows the scope of opportunistic attacks but makes this a significant insider risk.

Remediation

Upgrade the OWASP ZAP Plugin to a patched version released by the Jenkins project. Verify the exact patched version against the official Jenkins plugin repository and vendor advisories. As an interim measure, restrict Item/Configure permission to only trusted personnel and audit existing job configurations for suspicious build steps. Consider disabling the plugin entirely if it is not actively used.

Patch guidance

The Jenkins project has released security updates addressing this vulnerability. Consult the official Jenkins Security Advisory and the plugin's update center to identify and deploy the patched version. Test the upgrade in a non-production environment first to ensure compatibility with existing job configurations. After upgrading, review and re-validate the scope of Item/Configure permissions across your Jenkins instance to prevent lateral exploitation.

Detection guidance

Monitor Jenkins logs and audit trails for unusual build execution patterns, particularly jobs configured with the OWASP ZAP Plugin that execute unexpected commands on the controller. Inspect the Jenkins controller's process logs for signs of unauthorized command execution. Review job configurations for suspicious build steps, especially those that bypass agent node specifications. Network monitoring can detect unexpected outbound connections or data exfiltration from the controller. Consider using Jenkins security plugins to enforce stricter role-based access control and job execution policies.

Why prioritize this

This vulnerability warrants high priority due to the elevated privileges required (controller-level execution), the low barrier to entry (Item/Configure permission), and the direct path to sensitive infrastructure compromise. The HIGH CVSS score and the central role of the Jenkins controller in CI/CD pipelines make this a critical risk. Organizations relying on Jenkins as a core automation platform should prioritize patching immediately.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of factors: network accessibility (low barrier to reaching the vulnerability), low attack complexity (no special conditions required), and the requirement for low-level privileges (Item/Configure is typically granted to many users). The impact is severe across all three dimensions—confidentiality (theft of credentials and code), integrity (injection of malicious code into builds), and availability (disruption of CI/CD operations). The lack of user interaction and the unbounded scope (no container isolation) further elevate the risk.

Frequently asked questions