CVE-2026-57307: Medium severity Jenkins Zowe zDevOps Plugin vulnerability
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57307?
CVE-2026-57307 has a risk rating of 55, indicating a moderate severity vulnerability.
How do I fix CVE-2026-57307?
To fix CVE-2026-57307, upgrade the Jenkins Zowe zDevOps Plugin to version 1.1.3.50.ve350c9b_450b_1 or later.
Who is affected by CVE-2026-57307?
Users of the Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier are affected by CVE-2026-57307.
What type of attack is possible due to CVE-2026-57307?
CVE-2026-57307 allows attackers with Overall/Read permission to capture credentials stored in Jenkins by connecting to attacker-specified URLs.
When was CVE-2026-57307 published?
CVE-2026-57307 was published on June 24, 2026.