EUVD-2026-38786
GHSA-429r-3j78-2pxm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CSRF requires no attacker credentials (PR:N) but victim interaction (UI:R); scope changes as victim session is hijacked to affect Jenkins server.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
AnalysisAI
Cross-site request forgery in Jenkins Assembla Plugin 1.4 and earlier enables network-adjacent attackers to force an authenticated Jenkins user's session to initiate connections to attacker-controlled endpoints using attacker-supplied credentials. The plugin fails to validate CSRF tokens on its connection-triggering functionality, allowing external origins to forge legitimate-looking requests. No active exploitation has been identified (EPSS at 1st percentile, absent from CISA KEV), and SSVC assessment classifies exploitation as none with partial technical impact, placing this firmly in a lower remediation priority tier.
Technical ContextAI
The Jenkins Assembla Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_assembla_plugin) integrates Jenkins CI/CD with the Assembla project management and SCM platform. CWE-352 (Cross-Site Request Forgery) describes the root cause: the plugin exposes an action endpoint - likely for validating or testing Assembla connectivity - that does not enforce Jenkins' built-in CSRF protection (crumb validation). Jenkins provides a crumb issuer mechanism that all state-changing HTTP endpoints must implement; plugins that bypass or omit this check are vulnerable to forged cross-origin form submissions. The attack abuses the victim's authenticated browser session to submit a crafted request that the Jenkins server processes as legitimate, directing the plugin to connect to an arbitrary URL with credentials of the attacker's choosing.
RemediationAI
Consult the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(2) for the vendor-recommended fix - a specific patched plugin version number is not provided in the available intelligence data, so administrators should check the Jenkins plugin update center directly for a version superseding 1.4. If an updated plugin version is not yet available or the plugin is not actively required, the most effective compensating control is to disable or uninstall the Jenkins Assembla Plugin entirely via the Jenkins plugin manager, eliminating the vulnerable endpoint. As a secondary control, restrict Jenkins web UI access to trusted internal networks or VPN only, reducing the attack surface by preventing external origins from reaching the forged-request target. Note that network restriction alone does not eliminate risk if attackers have access to internal systems.
More in Jenkins Assembla Plugin
View allXML external entity (XXE) injection in the Jenkins Assembla Plugin version 1.4 and earlier lets an attacker who can cont
Jenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allo
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today