CVE-2026-48923 — Jenkins Project / Jenkins AppSpider Plugin

CVE-2026-48923

Jenkins Project / Jenkins AppSpider Plugin PUBLISHED

Description (CNA)

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins AppSpider Plugin	affected 0 through 1.0.17

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3671

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.