8.8
High
CVE-2026-57301 Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the…
Description
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins OWASP ZAP Plugin 1.0 | earliest → 1.0.7 | No fix stated |