CVE-2026-57303 — Jenkins Project / Jenkins Assembla Plugin

CVE-2026-57303

Jenkins Project / Jenkins Assembla Plugin PUBLISHED

Description (CNA)

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins Assembla Plugin	affected 0 through 1.4

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1)

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.