CVE-2026-57301 Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
Attackers with Item/Configure permission can execute arbitrary code on the Jenkins controller due to improper build operation handling in the OWASP ZAP Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57301?
CVE-2026-57301 is a high-severity code injection vulnerability in Jenkins OWASP ZAP Plugin, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
Weakness: CWE-610
Which versions are affected by CVE-2026-57301?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:zapper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:zapper Maven | All versions to 1.0.7 | None |
org.jenkins-ci.plugins:zapper Maven | All versions to 1.0.7 | None |
Products include Jenkins Official Owasp Zap.
How do I fix CVE-2026-57301?
No fix has been published for CVE-2026-57301 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-57301 being exploited?
There is no known exploitation of CVE-2026-57301 in the wild and no public exploit code.
Other vulnerabilities in Jenkins OWASP ZAP Plugin
Sources
Also known as GHSA-5qh3-hxx9-w26p.