EUVD-2026-38784
GHSA-2q27-6p2h-q6r3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attacker must control the Assembla server's responses (a non-trivial precondition) so AC:H rather than AC:L; PR:L for the configured-integration foothold; high confidentiality from secret/file disclosure, low integrity via SSRF, no availability impact.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.
Articles & Coverage 2
AnalysisAI
XML external entity (XXE) injection in the Jenkins Assembla Plugin version 1.4 and earlier lets an attacker who can control the HTTP responses of the configured Assembla server read sensitive files and secrets from the Jenkins controller and pivot into internal services via server-side request forgery. Mapped to CWE-918 (SSRF) with a CVSS 3.1 base score of 7.1 (high), there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as 'none' with only partial technical impact. Exploitation requires the attacker to influence what the Assembla endpoint returns, so it is a targeted rather than mass-exploitable condition.
Technical ContextAI
The plugin integrates Jenkins with Assembla (a hosted project/source management service) and parses XML responses returned by the configured Assembla server. The root cause is that the underlying XML parser is not hardened: external entity resolution and DTD processing are left enabled, the classic XXE misconfiguration. Because resolved external entities can reference local files (file:// URIs) or arbitrary network endpoints (http:// URIs), the flaw simultaneously yields information disclosure (reading controller-side secrets/config) and SSRF, which is why CWE-918 is assigned. The single affected CPE is cpe:2.3:a:jenkins_project:jenkins_assembla_plugin:*:*:*:*:*:*:*:*, scoping the issue to the Assembla plugin component running on a Jenkins controller rather than to Jenkins core.
RemediationAI
No vendor-released patched version is identified in the available data, so a specific upgrade target cannot be cited; consult the Jenkins advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1) for the current fix status and apply any released update once available. Until a fixed release is confirmed, the most effective compensating control is to uninstall or disable the Assembla Plugin if it is not essential (trade-off: loses Assembla integration). If it must remain in use, restrict and pin the configured Assembla server to a trusted, authenticated HTTPS endpoint and enforce certificate validation to prevent an attacker from substituting malicious XML responses or performing a man-in-the-middle (trade-off: requires verifying TLS configuration). Additionally, apply egress network filtering from the Jenkins controller so that XXE/SSRF-driven outbound requests to internal services and metadata endpoints are blocked (trade-off: may break legitimate integrations that rely on outbound calls), and limit who holds Job/Configure-level permissions on the controller.
More in Jenkins Assembla Plugin
View allJenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allo
Cross-site request forgery in Jenkins Assembla Plugin 1.4 and earlier enables network-adjacent attackers to force an aut
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today