CVE-2026-57299: 
Jenkins vulnerability analysis and mitigation

CVE-2026-57299 is a missing permission check vulnerability in the Jenkins Contrast Continuous Application Security Plugin that allows authenticated attackers to enumerate the names of configured Contrast metadata. It affects plugin versions 3.11 and earlier, and was disclosed on June 24, 2026 as part of the Jenkins Security Advisory 2026-06-24 (tracked as SECURITY-3697 (2)). The vulnerability was reported by Kai Aizen (SnailSploit). It carries a CVSS v3.1 base score of 4.3 (Medium) (Jenkins Advisory, GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): several HTTP endpoints in the plugin that populate list box options with configured Contrast metadata names do not enforce any permission checks before returning data. An attacker with only Overall/Read permission — the lowest level of authenticated access in Jenkins — can send requests to these endpoints and receive the names of all configured Contrast metadata entries. No special privileges, user interaction, or complex conditions are required beyond having a valid Jenkins account (Jenkins Advisory, GitHub Advisory).

Successful exploitation allows an authenticated low-privileged Jenkins user to enumerate the names of Contrast metadata configurations that should be restricted to administrators. While the direct impact is limited to information disclosure (no confidentiality impact on secrets, no availability impact), the exposed metadata names could assist an attacker in mapping the application security configuration and potentially support follow-on attacks. The CVSS scoring reflects a low integrity impact due to the unauthorized access to restricted resource listings (Jenkins Advisory, GitHub Advisory).

1. Reconnaissance: Identify a Jenkins instance with the Contrast Continuous Application Security Plugin version 3.11 or earlier installed. This can be done by checking the Jenkins plugin manager page (if accessible) or by probing known plugin-specific endpoints.
2. Authenticate: Log in to the Jenkins instance with any valid account that has Overall/Read permission — the minimum permission level granted to most authenticated users.
3. Access vulnerable endpoints: Send HTTP GET requests to the plugin's list box population endpoints (e.g., endpoints used to fill Contrast metadata dropdowns in job configuration forms) without providing elevated credentials.
4. Enumerate metadata: Parse the HTTP responses to extract the names of all configured Contrast metadata entries, which are returned without authorization enforcement.
5. Use gathered information: Leverage the enumerated metadata names to better understand the application security configuration, potentially informing further attacks against the Jenkins environment or the connected Contrast TeamServer (Jenkins Advisory).

• Network: Unusual or repeated HTTP GET requests from low-privileged user accounts to Contrast plugin form-fill or list box endpoints (e.g., URLs under /descriptorByName/ related to the contrast-continuous-application-security plugin).
• Logs: Jenkins access logs showing requests to Contrast plugin HTTP endpoints by accounts that do not normally interact with Contrast configuration; multiple rapid requests to metadata enumeration endpoints from a single user.
• Behavior: Low-privileged accounts accessing plugin configuration endpoints that are not part of normal job build or read workflows.

Update the Contrast Continuous Application Security Plugin to version 3.12 or later, which requires the appropriate permission to enumerate configured Contrast metadata. The fix is available via the Jenkins Update Center as of June 24, 2026. As an interim measure, restrict Overall/Read access to trusted users only and audit which accounts have access to the Jenkins instance (Jenkins Advisory).