---
id: CVE-2026-57299
title: >-
  Missing permission checks in Jenkins Contrast Continuous Application Security
  Plugin 3.11 and earlier allow attackers with Overall/Read permission to
  enumerate the names of configured Contrast metadata.
summary: >-
  Missing permission checks in Jenkins Contrast Continuous Application Security
  Plugin 3.11 and earlier allow attackers with Overall/Read permission to
  enumerate the names of configured Contrast metadata.
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: jenkins
product: contrast_continuous_application_security
affected:
  - contrast_continuous_application_security <= 3.11
published: '2026-06-24'
updated: '2026-07-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57299'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(2)'
    label: jenkinsci-cert@googlegroups.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57299'
  - url: >-
      https://github.com/jenkinsci/contrast-continuous-application-security-plugin/commit/d7776646af26d928cb0d50922d61dadc2c6aa11c
  - url: >-
      https://github.com/jenkinsci/contrast-continuous-application-security-plugin/releases/tag/contrast-continuous-application-security-3.12
  - url: 'https://github.com/advisories/GHSA-8263-qv4g-vfxr'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.0025
epssPercentile: 0.145
ingestedAt: '2026-07-06T17:44:51.209Z'
aliases:
  - GHSA-8263-qv4g-vfxr
ecosystem: maven
patched:
  - 'org.jenkins-ci.plugins:contrast-continuous-application-security 3.12'
---

## Overview

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

## Affected

- `contrast_continuous_application_security <= 3.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-57299)

Affected packages:

- `org.jenkins-ci.plugins:contrast-continuous-application-security < 3.12`

Patched in:

- `org.jenkins-ci.plugins:contrast-continuous-application-security 3.12`

Source: https://github.com/advisories/GHSA-8263-qv4g-vfxr