CVE-2026-57303

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-918

Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

Affected products

Jenkins Project Jenkins Assembla Plugin: through 1.4

References

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1)

Get alerted when CVE-2026-57303 or the next vulnerability affects your stack