CVE-2026-57297 describes a missing permission check vulnerability in Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier. This flaw permits attackers who have Overall/Read permission in Jenkins to initiate connections to attacker-controlled URLs using attacker-supplied usernames, API keys, and service keys. The vulnerability arises from insufficient access control validation in the plugin's functionality that handles external connections.

An attacker with Overall/Read permission can abuse this vulnerability to make the Jenkins server connect to arbitrary URLs with attacker-controlled credentials. This could potentially be used to exfiltrate data or interact with external systems in an unauthorized manner. However, the vulnerability requires the attacker to already have Overall/Read permission, which limits the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Overall/Read permissions to trusted users only to reduce risk. Monitor Jenkins plugin updates for a security patch addressing this issue.