1. Home
  2. CVE Database
  3. CVE-2026-57303
HIGH · 7.1

CVE-2026-57303

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla serv...

Vulnerability Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

CVSS Score

7.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
JenkinsAssembla<= 1.4

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2026-57303?

CVE-2026-57303 is a vulnerability with a CVSS score of 7.1 (HIGH). Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla serv...

How severe is CVE-2026-57303?

CVE-2026-57303 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-57303?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Assembla.