CVE-2026-57303

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

CVSS 3.1

7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-25)

CWE

CWE-918

Published

2026-06-24

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• jenkins:assembla

Packages (OSV)

References

• https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1)

Check your stackJSON