A missing permission check in Jenkins Contrast Continuous Application Security Plugin version 3.11 and all earlier releases allows an attacker who has Overall or Read access in a Jenkins instance to configure the plugin to direct the Jenkins server to connect to an arbitrary external URL using attacker‑specified credentials. This is an authorization bypass (CWE‑862) that enables the attacker to force outbound network traffic from the Jenkins server, potentially exposing internal data or sending data to a malicious endpoint. No evidence of remote code execution is provided; the impact is limited to unauthorized external connectivity.

The vulnerability affects installations that have the Contrast Continuous Application Security Plugin 3.11 or earlier. Only Jenkins environments where the plugin is present and a user has Overall or Read permissions are susceptible. If a Jenkins instance does not use this plugin or does not grant users the concerned permissions, the flaw does not apply.

The EPSS score is less than 1% and the flaw is not included in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The CVSS score of 5.4 indicates moderate severity. Because the flaw requires only legitimate access to the Jenkins UI with Overall or Read privileges—permissions that many users may possess—affected installations can be considered at moderate to high risk. An attacker can use the UI or API to provide the plugin with a malicious endpoint, causing the Jenkins server to initiate outbound traffic and potentially exfiltrate data or communicate with compromised services.