EUVD-2026-38785
GHSA-2r5w-jh6g-8hff
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L reflects mandatory authenticated Jenkins session; C:L and I:L capture credential leakage and SSRF capability without full system compromise.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
AnalysisAI
Jenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allowing any Jenkins user holding only Overall/Read permission to trigger outbound HTTP connections to an arbitrary attacker-controlled URL with attacker-supplied credentials. This enables both a limited Server-Side Request Forgery (SSRF) vector for internal network probing and credential interception on the attacker's endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none.
Technical ContextAI
The Jenkins Assembla Plugin integrates the Jenkins CI/CD platform with the Assembla project management service. The root cause is CWE-862 (Missing Authorization): a form-validation or connection-test handler within the plugin performs an outbound HTTP request using caller-supplied URL and credentials, but fails to verify that the invoking principal holds any permission beyond the baseline Overall/Read grant - the lowest functional permission in Jenkins' authorization model. This is a well-documented anti-pattern in Jenkins plugin development where connection-test endpoints bypass the permission checks enforced on the broader configuration page. CPE cpe:2.3:a:jenkins_project:jenkins_assembla_plugin:*:*:*:*:*:*:*:* scoped to versions ≤1.4 confirms the affected artifact as the official Jenkins Project-maintained plugin.
RemediationAI
Upgrade Jenkins Assembla Plugin to a version that addresses SECURITY-3692 as directed by the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(2). Note that an exact fixed release version number is not independently confirmed from the available input data - consult the advisory directly to identify the minimum safe version. If Assembla integration is not actively used, uninstalling the plugin entirely eliminates the attack surface with no functional trade-off. As a compensating control where immediate patching is not feasible, tighten the Jenkins authorization strategy to ensure Overall/Read is granted only to fully trusted internal users, which narrows the exploitable population; this does not eliminate the flaw but reduces exposure.
More in Jenkins Assembla Plugin
View allXML external entity (XXE) injection in the Jenkins Assembla Plugin version 1.4 and earlier lets an attacker who can cont
Cross-site request forgery in Jenkins Assembla Plugin 1.4 and earlier enables network-adjacent attackers to force an aut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today