CVE-2026-48923
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permissi…
Published May 27, 2026 · updated Oct 14, 2026 · jenkins appspider
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 27, 2026 · NIST NVD
Detected
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
Oct 14, 2026 · NIST NVD
Updated
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
Affected
- cpe jenkins/appspiderversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-48923
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-48923
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-48923
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
nvd.nist.gov