CVE-2026-57307

Name of the Vulnerable Software and Affected Versions Jenkins Zowe zDevOps Plugin versions prior to 1.1.3.50.ve350c9b 450b 1

Description A missing permission check allows users with Overall/Read permission to initiate a connection to an arbitrary URL. By providing a specific URL and credentials IDs obtained through other means, an attacker can capture credentials stored within Jenkins.

Recommendations Update Jenkins Zowe zDevOps Plugin to a version later than 1.1.3.50.ve350c9b 450b 1.