CVE-2026-57306Medium· 4.2▾ SunlitJenkins Zowe zDevOps Plugin has a CSRF vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.2%
Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
io.jenkins.plugins:zdevops <= 1.1.3.50.ve350c9bRefer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57307Medium· 4.2Jenkins Zowe zDevOps Plugin has a missing permission check
CVE-2026-57283Medium· 4.3Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
CVE-2026-57300Medium· 4.3Jenkins MCP Server Plugin missing a permission check
CVE-2026-57289Medium· 4.8Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
CVE-2026-57284Medium· 4.3Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
CVE-2017-20120Medium· 4.3A vulnerability classified as problematic was found in TrueConf Server 4.3.7