CVE-2026-57298
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
Summary dbcve.org
CSRF vulnerability in Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier allows attackers to trick Jenkins into making outbound connections to attacker-controlled URLs using attacker-supplied credentials (username, API key, and service key). This enables credential theft, data exfiltration, or further compromise of the Jenkins infrastructure.
Mitigation
Update the Jenkins Contrast Continuous Application Security Plugin to a version newer than 3.11 which includes proper CSRF protection. Ensure Jenkins global CSRF protection is enabled in Jenkins global security settings.