CVE-2026-57307 describes a missing permission check vulnerability in the Jenkins Zowe zDevOps Plugin (version 1.1.3.50.ve350c9b_450b_1 and earlier). Attackers who have Overall/Read permission can exploit this flaw by connecting to a URL of their choice using credentials IDs they have obtained through other means. This allows them to capture credentials stored within Jenkins, potentially leading to unauthorized access to sensitive information.

The vulnerability allows attackers with limited read permissions to leverage stored credentials in Jenkins by connecting to attacker-controlled URLs. This could lead to credential exposure and unauthorized access to systems or services that rely on those credentials. The impact is significant because it bypasses intended permission restrictions and exposes sensitive authentication data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Overall/Read permissions to trusted users only and monitor for suspicious activity related to credential usage. Avoid granting unnecessary permissions that could be leveraged to exploit this vulnerability.