# CVE-2026-57304: Jenkins Assembla Plugin missing permission check in connection endpoint

Source: https://junglewise.ai/threats/cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-57304 · Severity: medium · CVSS 5.4 · Published 2026-06-24

The Jenkins Assembla Plugin, which integrates Jenkins with the Assembla project management platform, contains a security flaw due to a missing permission check. This allows any user with basic 'Read' access to the Jenkins dashboard to force the server to connect to an arbitrary web address using credentials provided by the attacker. This could be used to probe internal network services or facilitate further attacks by masking the attacker's true origin.

Technologies: [Jenkins Project Assembla Plugin](https://junglewise.ai/threats/technologies/assembla-plugin), [org.jenkins-ci.plugins:assembla (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-assembla). Vendors: [Jenkins Project](https://junglewise.ai/threats/vendors/jenkins-project), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-57304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57304 being exploited in the wild.

**How severe is CVE-2026-57304?** Medium severity, with a CVSS score of 5.4, published 24 June 2026.

**Which products and versions are affected?** Jenkins Project Assembla Plugin 1.4 and earlier; org.jenkins-ci.plugins:assembla (Maven) <= 1.4, ECOSYSTEM:introduced=0,last_affected=1.4.

**Is there a fix for CVE-2026-57304?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57304 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57304?** Check whether you run Jenkins Project Assembla Plugin or org.jenkins-ci.plugins:assembla (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing permission check in the Jenkins Assembla Plugin versions 1.4 and earlier allows an authenticated attacker with Overall/Read permissions to trigger an outbound connection from the Jenkins controller. By exploiting an unprotected HTTP endpoint, an attacker can specify a target URL and provide arbitrary credentials (username and password) for the connection. This vulnerability is a form of Server-Side Request Forgery (SSRF) that can be used to interact with internal network resources or external systems. As of the advisory date, there is no mention of a fixed version; users are advised to check for updates from the Jenkins project.

## Affected products

- Jenkins Project Assembla Plugin 1.4 and earlier

## Identifiers

- CVE-2026-57304
- GHSA-2r5w-jh6g-8hff

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory

## References

- [https://www.jenkins.io/security/advisory/2026-06-24/](https://www.jenkins.io/security/advisory/2026-06-24/)

## Related threats

- [Jenkins Assembla Plugin CSRF in connection endpoint](https://junglewise.ai/threats/cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint)
- [Jenkins Assembla Plugin XXE in XML parser](https://junglewise.ai/threats/cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser)
- [Jenkins Assembla Plugin has Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2019-10420-jenkins-assembla-plugin-has-insufficiently-protected-credentials)