CVE-2026-57304 describes a missing permission check vulnerability in Jenkins Assembla Plugin versions prior to 1.5. This flaw permits attackers who have Overall/Read permission in Jenkins to cause the plugin to connect to a URL specified by the attacker, using a username and password also controlled by the attacker. This could potentially be leveraged to interact with external systems or services under attacker control.

The vulnerability allows users with limited read permissions to initiate connections to attacker-controlled URLs with attacker-supplied credentials. This may lead to unauthorized interactions with external systems or unintended information disclosure depending on the context of the connection. However, the vulnerability does not allow privilege escalation beyond Overall/Read permission.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor Jenkins Project advisories for updates and consider restricting Overall/Read permissions to trusted users until a fix is available.