Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
Jenkins OWASP ZAP Plugin 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to configure the feature to build an attacker-controlled project, executing arbitrary code on the Jenkins controller and bypassing any restriction confining the build to a specific agent. As of publication of this advisory, there is no fix.
GHSA-5qh3-hxx9-w26p
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-5qh3-hxx9-w26p
org.jenkins-ci.plugins:zapper
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions1.0.7Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.7"
}
]
}
],
"package": {
"name": "org.jenkins-ci.plugins:zapper",
"purl": "pkg:maven/org.jenkins-ci.plugins/zapper",
"ecosystem": "Maven"
},
"versions": [
"1.0.0",
"1.0.7"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5qh3-hxx9-w26p/GHSA-5qh3-hxx9-w26p.json"
}
}
]- Related CVEs
- CVE-2026-57301
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #17850 · Revision 1
- Added to Heist Feed
- Publisher date