Jenkins AppSpider Plugin EUVD-2026-32514

Exploitation requires the attacker to hold an active Jenkins account with at minimum Overall/Read permission - the lowest non-anonymous privilege level in Jenkins. The Jenkins AppSpider Plugin version 1.0.17 or earlier must be installed and active on the target instance. No special plugin configuration or feature activation is required beyond the plugin being present; the vulnerable form validation endpoint is accessible as part of normal plugin operation. Exploitation is limited by the requirement for authenticated access (PR:L per CVSS vector), meaning anonymous or external-only threat actors cannot exploit this directly. The practical impact is further constrained by the attacker needing knowledge of internal network addresses worth targeting, which the CISA SSVC non-automatable rating reflects.

The CVSS base score of 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects a constrained but real integrity-affecting issue. The scope is unchanged (S:U), meaning the vulnerability does not break the Jenkins security sandbox boundary into other components. Confidentiality impact is none (C:N), which may understate the practical risk - SSRF primitives frequently yield internal network topology information even when the CVSS model does not score them as confidentiality impacts. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. CISA SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial - consistent with a low-privilege, single-step operation that requires a Jenkins account rather than a fully unauthenticated attack path. The non-automatable rating reflects that meaningful exploitation requires knowledge of internal network topology to select useful target URLs. No KEV listing and no public exploit code exist at time of analysis, placing this squarely in the low-urgency tier for most organizations unless Jenkins instances are exposed to untrusted authenticated users (e.g., shared CI environments, contractor accounts).

An attacker with a low-privilege Jenkins account (Overall/Read) submits a crafted form validation request targeting the AppSpider Plugin configuration endpoint, specifying an internal IP address (e.g., 169.254.169.254 for cloud metadata services, or an internal database listener) as the target URL. The Jenkins server initiates an outbound HTTP connection to the specified address, enabling the attacker to map reachable internal services or interact with unauthenticated internal APIs. No public exploit code exists at time of analysis, but the attack requires only standard HTTP tooling given the straightforward nature of the missing permission check.