All vulnerabilities
CVE-2026-57307GHSA-xx59-jv36-5r44

io.jenkins.plugins:zdevops: Jenkins Zowe zDevOps Plugin has a missing permission check

Jenkins Project io.jenkins.plugins:zdevopsmavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

Text from GitHub Advisory Database

Affected versions 6

  • io.jenkins.plugins:zdevops, maven<= 1.1.3.50.ve350c9bGitHub
  • Jenkins Zowe zDevOps Pluginaffected: all versions through 1.1.3.50.ve350c9b_450b_1CVE List
  • io.jenkins.plugins:zdevops, Mavenfrom first release, through 1.1.3.50.ve350c9bOSV
  • io.jenkins.plugins:zdevops, Maven1.0.0OSV
  • io.jenkins.plugins:zdevops, Maven1.1.0.41.v8225342cf372OSV
  • io.jenkins.plugins:zdevops, Maven1.1.1.45.v49482a_47e945OSV

References 3