Executive brief
The Jenkins Assembla Plugin, which integrates Jenkins with the Assembla development platform, contains a security flaw in how it processes data. An attacker who can control the responses from a configured Assembla server can exploit this to steal sensitive secrets from the Jenkins controller or force the server to make unauthorized requests to other internal systems. This could lead to the exposure of credentials or unauthorized access to private network resources.
Technical details
The Jenkins Assembla Plugin 1.4 and earlier does not properly configure its XML parser to disable external entity resolution. This vulnerability class is XML External Entity (XXE) injection. An attacker who can control or spoof the responses from the configured Assembla server can provide a malicious XML payload. When parsed by the Jenkins controller, this payload can be used to extract local files (including secrets), or perform Server-Side Request Forgery (SSRF) to probe or attack internal network services. As of the advisory date, a specific patch version was not explicitly detailed in the provided snippet, though the vulnerability is confirmed in versions up to 1.4.
Affected products
- Jenkins Project Assembla Plugin 1.4 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory