PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48923 Jenkins Project CVE debrief

A missing permission check in the Jenkins AppSpider Plugin (versions 1.0.17 and earlier) allows attackers with Overall/Read permission to connect to attacker-specified URLs through a form validation method. This vulnerability, disclosed in the Jenkins security advisory for May 27, 2026, enables unauthorized Server-Side Request Forgery (SSRF) capabilities that could be leveraged for internal network reconnaissance or accessing restricted resources. The CVSS 3.1 score of 4.3 (Medium) reflects the limited impact (integrity only) and the requirement for authenticated access with low privileges. The vulnerability is classified under CWE-269 (Improper Privilege Management).

Vendor
Jenkins Project
Product
Jenkins AppSpider Plugin
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Jenkins administrators operating instances with the AppSpider Plugin installed, security teams managing CI/CD infrastructure, and organizations using Jenkins for application security testing workflows

Technical summary

The Jenkins AppSpider Plugin implements form validation functionality that fails to verify appropriate permissions before executing. An attacker possessing only Overall/Read permission—typically granted to basic authenticated users—can manipulate form validation requests to cause the Jenkins server to initiate connections to arbitrary URLs specified by the attacker. This represents an SSRF vulnerability where the trusted Jenkins server becomes a proxy for attacker-directed network requests. The vulnerability exists in the plugin's form validation method implementation, which should enforce Item/Configure or equivalent administrative permissions but instead permits low-privileged access.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Jenkins AppSpider Plugin to a version newer than 1.0.17 when available
  • Review Jenkins audit logs for suspicious URL connection attempts from users with Overall/Read permission
  • Implement network segmentation to restrict Jenkins server outbound connectivity
  • Apply principle of least privilege by auditing and minimizing Overall/Read permission assignments
  • Monitor for plugin updates through Jenkins Update Center and subscribe to Jenkins security advisories

Evidence notes

Vulnerability confirmed through official Jenkins security advisory (SECURITY-3671) and NVD entry. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Affected versions explicitly stated as 1.0.17 and earlier.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48923 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48923

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48923 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48923

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.