{"id":"CVE-2026-57298","aliases":["GHSA-6qc4-57v3-28rr"],"title":"Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability","summary":"Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability","severity":"medium","cvss":5.4,"cwe":["CWE-352"],"vendor":"jenkins-ci","product":"org.jenkins-ci.plugins:contrast-continuous-application-security","ecosystem":"maven","affected":["org.jenkins-ci.plugins:contrast-continuous-application-security < 3.12"],"patched":["org.jenkins-ci.plugins:contrast-continuous-application-security 3.12"],"published":"2026-06-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T19:13:06Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6qc4-57v3-28rr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57298"},{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1)"},{"url":"https://github.com/jenkinsci/contrast-continuous-application-security-plugin/commit/ddea0a815aec52c0695d8c0c7f09f9cfce4989e5"},{"url":"https://github.com/jenkinsci/contrast-continuous-application-security-plugin/releases/tag/contrast-continuous-application-security-3.12"},{"url":"https://github.com/advisories/GHSA-6qc4-57v3-28rr"}],"tags":["ghsa","maven"],"epss":0.00136,"epssPercentile":0.02476,"ingestedAt":"2026-09-25T19:15:38.958Z","slug":"CVE-2026-57298","body":"## Overview\n\nJenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.\n\nAdditionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nContrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.\n\n## Affected packages\n\n- `org.jenkins-ci.plugins:contrast-continuous-application-security < 3.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.jenkins-ci.plugins:contrast-continuous-application-security 3.12`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}