A cross‑site request forgery vulnerability (CWE‑352) in the Jenkins Contrast Continuous Application Security Plugin allows an attacker to force Jenkins to connect to a URL chosen by the attacker, using credentials supplied by the attacker. This could enable the attacker to obtain access tokens, privileged API keys, or other secrets, and to initiate unauthorized connections to internal or external services without the user’s explicit consent. The impact is the potential for credential theft and illicit remote activity originating from the Jenkins server, thereby compromising the confidentiality and integrity of the infrastructure it services.

The flaw exists in the Jenkins Contrast Continuous Application Security Plugin version 3.11 and earlier. The plugin is distributed by the Jenkins Project and is used to integrate Contrast’s application security analysis into Jenkins jobs.

The CVSS score is 5.4, EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently known to be widely exploited. The attack requires a user to be authenticated to the Jenkins instance; once CSRF is achieved, the attacker can supply arbitrary connection parameters. The risk is considered moderate owing to the CVSS rating, though the potential for credential compromise and unauthorized remote connections remains significant.