CVE-2026-57305
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
Summary dbcve.org
This is a CSRF vulnerability in Jenkins Assembla Plugin versions 1.4 and earlier. The flaw allows authenticated Jenkins users to be tricked into making unintended requests that cause the Jenkins server to connect to attacker-specified URLs using attacker-specified credentials. This could enable credential theft or man-in-the-middle attacks against the Jenkins infrastructure.
Mitigation
Upgrade the Assembla Plugin to a version that includes CSRF protection (crumb validation). If no patched version is available, disable the plugin until a fix is released, or implement network-level controls to restrict outbound connections from the Jenkins server.