CVE-2026-57305: Jenkins Assembla Plugin CSRF Vulnerability
Summary
CVE-2026-57305: Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability. Affects org.jenkins-ci.plugins:assembla versions < 1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Assembla Plugin is an integration tool that allows Jenkins users to connect with Assembla, a project management and collaboration platform. This plugin facilitates seamless communication between Jenkins and Assembla, enabling users to manage their projects more effectively. However, the plugin versions 1.4 and earlier are vulnerable to a cross-site request forgery (CSRF) attack due to inadequate permission checks and lack of POST request enforcement.
Vulnerability Detail
The Jenkins Assembla Plugin versions 1.4 and earlier contain a CSRF vulnerability that arises from the absence of permission checks in an HTTP endpoint designed for testing connections to an Assembla server. This flaw allows attackers with Overall/Read permission to exploit the vulnerability by connecting to a malicious URL using arbitrary credentials. The lack of POST request enforcement further exacerbates the issue, making it easier for attackers to execute CSRF attacks without user interaction.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for mitigating this vulnerability. Users should consider restricting access to the Jenkins instance and monitoring for any unauthorized activities until a patch is released.
Conclusion
The Jenkins Assembla Plugin has a significant CSRF vulnerability that affects versions 1.4 and earlier. Users are advised to monitor for updates and restrict access to their Jenkins instances until a fix is available. Utilizing tools like Vulert can help in identifying vulnerabilities in your software.
See every vulnerability recorded for org.jenkins-ci.plugins:assembla →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
The vulnerability affects Jenkins Assembla Plugin versions 1.4 and earlier.
This vulnerability can facilitate cross-site request forgery (CSRF) attacks, allowing attackers to connect to malicious URLs using arbitrary credentials.
As of now, there is no patch available for this vulnerability. Users should keep an eye on the plugin repository for updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:assembla.
