CVE-2026-57301

—

CVSS 3.1

8.8 high

EPSS

<1%p48

Published

Jun 24, 2026 (Jun 24, 2026)

Modified

Jun 26, 2026

Description

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Vendors: jenkins
Products: official owasp zap
Weakness: CWE-610
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.