CVE-2026-57305: Jenkins Assembla Plugin CSRF in connection endpoint

CVE-2026-57305 · Severity: medium · CVSS 5.4 · Published 2026-06-24

The Jenkins Assembla Plugin, which integrates Jenkins with the Assembla project management platform, contains a security flaw. This vulnerability allows an attacker to trick a user into making an unauthorized request that connects Jenkins to a server controlled by the attacker. This could lead to the exposure of sensitive credentials or unauthorized communication between systems.

Technologies: Jenkins Project Assembla Plugin, org.jenkins-ci.plugins:assembla (Maven). Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57305 being exploited in the wild.
How severe is CVE-2026-57305?
Medium severity, with a CVSS score of 5.4, published 24 June 2026.
Which products and versions are affected?
Jenkins Project Assembla Plugin 1.4 and earlier; org.jenkins-ci.plugins:assembla (Maven) <= 1.4, ECOSYSTEM:introduced=0,last_affected=1.4.
Is there a fix for CVE-2026-57305?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57305 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57305?
Check whether you run Jenkins Project Assembla Plugin or org.jenkins-ci.plugins:assembla (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins Assembla Plugin versions 1.4 and earlier. The flaw resides in an HTTP endpoint that lacks proper CSRF protection, allowing an attacker to craft a malicious request that forces the Jenkins server to initiate a connection to an arbitrary URL. This connection can include attacker-specified credentials (username and password). An attacker could exploit this by social engineering a Jenkins administrator into visiting a malicious site, potentially leading to credential disclosure or Server-Side Request Forgery (SSRF) style attacks. As of the advisory date, no patch has been specified in the provided text, though the plugin is identified as affected up to version 1.4.

Affected products

  • Jenkins Project Assembla Plugin 1.4 and earlier

Identifiers

  • CVE-2026-57305
  • GHSA-429r-3j78-2pxm

Timeline

  • 2026-06-24: disclosed: Vulnerability published in Jenkins Security Advisory.
  • 2026-06-24: advisory: NVD record published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.