All vulnerabilities
CVE-2026-57301GHSA-5qh3-hxx9-w26p

org.jenkins-ci.plugins:zapper: Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Jenkins Project org.jenkins-ci.plugins:zappermavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.63%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Jenkins OWASP ZAP Plugin 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to.

This allows attackers with Item/Configure permission to configure the feature to build an attacker-controlled project, executing arbitrary code on the Jenkins controller and bypassing any restriction confining the build to a specific agent.

As of publication of this advisory, there is no fix.

Text from GitHub Advisory Database

Affected versions 5

  • org.jenkins-ci.plugins:zapper, maven<= 1.0.7GitHub
  • Jenkins OWASP ZAP Pluginaffected: all versions through 1.0.7CVE List
  • org.jenkins-ci.plugins:zapper, Mavenfrom first release, through 1.0.7OSV
  • org.jenkins-ci.plugins:zapper, Maven1.0.0OSV
  • org.jenkins-ci.plugins:zapper, Maven1.0.7OSV

References 3