CVE-2026-57303

Analyzed Analyzed - Analysis Complete

Jenkins Assembla Plugin XXE Vulnerability

Publication date: 2026-06-24

Last updated on: 2026-06-25

Assigner: Jenkins Project

Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-25

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57303

EUVD

EUVD-2026-38784

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	assembla	to 1.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

The Jenkins Assembla Plugin version 1.4 and earlier has a security flaw because it does not properly configure its XML parser to prevent XML external entity (XXE) attacks.

This means that an attacker who can control the responses from the configured Assembla server can exploit this vulnerability to extract sensitive information from the Jenkins controller or perform server-side request forgery.

Impact Analysis

This vulnerability can allow attackers to extract secrets from the Jenkins controller, which may include sensitive configuration data or credentials.

Additionally, attackers can perform server-side request forgery (SSRF), potentially allowing them to make unauthorized requests from the Jenkins server to internal or external systems.

Compliance Impact

The vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to extract secrets from the Jenkins controller or perform server-side request forgery by exploiting XML external entity (XXE) attacks.

Such unauthorized access to sensitive information could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal and sensitive data.

Therefore, if exploited, this vulnerability could compromise compliance with these standards by exposing protected data or enabling unauthorized actions within the affected Jenkins environment.

Hi! I’m here to help you understand CVE-2026-57303. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70