CVE-2026-57303

Name of the Vulnerable Software and Affected Versions Jenkins Assembla Plugin versions prior to 1.5

Description The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location.

Recommendations Update Jenkins Assembla Plugin to version 1.5 or later.