CVE-2019-1003060: Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Je...

Security readout for executives and security teams

This Jenkins plugin risk is about credential handling, not remote code execution. The Official OWASP ZAP Plugin stored credentials in plaintext in the Jenkins controller global configuration file. Anyone who can access that filesystem could read those secrets and potentially reuse them elsewhere. Exposure is most likely on Jenkins controllers using the Official OWASP ZAP Plugin before or around April 2019, especially where administrators, operators, backup systems, or compromised processes can read Jenkins configuration files. Treat this as a credential exposure issue with moderate urgency. Prioritize environments where Jenkins has broad deployment access, sensitive secrets, or many users with server-level access. Mitigation focus: Check Jenkins SECURITY-1041 and plugin update guidance for vendor remediation.; Inventory Jenkins controllers for the Official OWASP ZAP Plugin.; Restrict filesystem access to the Jenkins controller and configuration backups..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.