All vulnerabilities
CVE-2026-57303GHSA-2q27-6p2h-q6r3

org.jenkins-ci.plugins:assembla: Jenkins Assembla Plugin has an XXE vulnerability

Jenkins Project org.jenkins-ci.plugins:assemblamavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when parsing responses from the configured Assembla server.

This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

As of publication of this advisory, there is no fix.

Text from GitHub Advisory Database

Affected versions 6

  • org.jenkins-ci.plugins:assembla, maven<= 1.4GitHub
  • Jenkins Assembla Pluginaffected: all versions through 1.4CVE List
  • org.jenkins-ci.plugins:assembla, Mavenfrom first release, through 1.4OSV
  • org.jenkins-ci.plugins:assembla, Maven1.2OSV
  • org.jenkins-ci.plugins:assembla, Maven1.3OSV
  • org.jenkins-ci.plugins:assembla, Maven1.4OSV

References 3