CVE-2026-57301 — Vulnerability in org.jenkins-ci.plugins:zapper —...

HIGH

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Published June 24, 2026Updated September 25, 2026Source: osv

Summary

Jenkins OWASP ZAP Plugin 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to configure the feature to build an attacker-controlled project, executing arbitrary code on the Jenkins controller and bypassing any restriction confining the build to a specific agent. As of publication of this advisory, there is no fix.

Advisory Timeline

First published June 24, 2026 (110 days ago).
Last revised September 25, 2026 — 93 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.jenkins-ci.plugins:zapper	maven	1.0.0, 1.0.7	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-610
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-57301?: Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-57301?: CVE-2026-57301 affects org.jenkins-ci.plugins:zapper. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-57301 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-5qh3-hxx9-w26p

Related CVEs

CVE-2023-25765
CRITICAL
Sandbox escape in Jenkins Email Extension Plugin
CVE-2020-2279
CRITICAL
Sandbox bypass vulnerability in Jenkins Script Security Plugin
CVE-2022-43403
CRITICAL
Jenkins Script Security Plugin sandbox bypass vulnerability
CVE-2023-24443
CRITICAL
XML Entity Expansion in Jenkins TestComplete support Plugin
CVE-2023-24430
CRITICAL
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
CVE-2022-43402
CRITICAL
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
CVE-2026-57296
HIGH
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
CVE-2026-48920
HIGH
Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies