CVE-2026-57301: High severity Jenkins OWASP ZAP Plugin vulnerability
Published Jun 24, 2026
·Updated
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
Affected Software
2 affected components
Jenkins OWASP ZAP Plugin<=1.0.7
Jenkins Official Owasp Zap Jenkins<=1.0.7
Event History
Jun 24, 2026
CVE Published
via MITRE·01:20 PM
Data Sourced
via MITRE·01:20 PM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-57301?
CVE-2026-57301 has a risk rating of 57, indicating a moderate level of severity.
2
How do I fix CVE-2026-57301?
To fix CVE-2026-57301, upgrade the Jenkins OWASP ZAP Plugin to version 1.0.8 or later.
3
What types of permissions can exploit CVE-2026-57301?
CVE-2026-57301 can be exploited by attackers who have Item/Configure permissions.
4
What impact does CVE-2026-57301 have on the Jenkins controller?
CVE-2026-57301 allows for arbitrary code execution on the Jenkins controller.
5
Are earlier versions of the Jenkins OWASP ZAP Plugin affected by CVE-2026-57301?
Yes, Jenkins OWASP ZAP Plugin versions 1.0.7 and earlier are affected by CVE-2026-57301.