What is the CVSS score of CVE-2026-48923?

CVE-2026-48923 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48923?

Yes, a patch is available for CVE-2026-48923. Update the affected software to the latest version immediately.

Jenkins AppSpider Plugin CVE-2026-48923

EUVD-2026-32514 MEDIUM

Improper Privilege Management (CWE-269)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-9wm7-8qf3-9v98

Privilege Escalation Jenkins

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:13 vuln.today

DescriptionCVE.org

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

AnalysisAI

Missing permission check in Jenkins AppSpider Plugin 1.0.17 and earlier allows any authenticated user with Overall/Read permission to force the Jenkins server to initiate connections to arbitrary attacker-specified URLs via a form validation endpoint. This constitutes a server-side request forgery (SSRF)-class primitive - an attacker can leverage this to probe internal network services, perform port scanning, or interact with internal infrastructure reachable by the Jenkins host. No public exploit has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.

Technical ContextAI

The Jenkins AppSpider Plugin integrates Rapid7's AppSpider dynamic application security testing tool with Jenkins CI/CD pipelines. The vulnerability resides in a form validation handler - a Jenkins UI mechanism that validates configuration fields in real time via HTTP. CWE-269 (Improper Privilege Management) identifies the root cause: the validation method executes a privileged network operation (outbound HTTP connection) without verifying that the requesting user holds the necessary permissions (typically Overall/Administer or a dedicated credential permission). Because Jenkins form validation methods are accessible to any authenticated user at the Overall/Read level by default, the permission boundary is effectively bypassed. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the operation is remotely exploitable over the network with low-privilege credentials and no user interaction required. Affected versions are Jenkins AppSpider Plugin 0 through 1.0.17 inclusive, as documented by ENISA EUVD-2026-32514.

RemediationAI

The primary remediation is to upgrade the Jenkins AppSpider Plugin to a version released after 1.0.17, as the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3671 documents this fix. Note: an exact fixed version number was not independently confirmed in the provided input data - consult the Jenkins Update Center or the linked advisory directly to identify the patched release before deploying. If an immediate upgrade is not possible, a compensating control is to restrict Overall/Read access to fully trusted users only, eliminating the low-privilege attacker prerequisite; this may affect other Jenkins functionality that relies on broad read access. Alternatively, network-level egress filtering on the Jenkins host can limit the usefulness of the SSRF primitive by blocking connections to internal network ranges, though this does not eliminate the underlying vulnerability and may impact legitimate AppSpider scanning workflows.