Executive brief
The Jenkins Assembla Plugin, which integrates Jenkins with the Assembla project management platform, contains a security flaw due to a missing permission check. This allows any user with basic 'Read' access to the Jenkins dashboard to force the server to connect to an arbitrary web address using credentials provided by the attacker. This could be used to probe internal network services or facilitate further attacks by masking the attacker's true origin.
Technical details
A missing permission check in the Jenkins Assembla Plugin versions 1.4 and earlier allows an authenticated attacker with Overall/Read permissions to trigger an outbound connection from the Jenkins controller. By exploiting an unprotected HTTP endpoint, an attacker can specify a target URL and provide arbitrary credentials (username and password) for the connection. This vulnerability is a form of Server-Side Request Forgery (SSRF) that can be used to interact with internal network resources or external systems. As of the advisory date, there is no mention of a fixed version; users are advised to check for updates from the Jenkins project.
Affected products
- Jenkins Project Assembla Plugin 1.4 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory