CVE-2026-48923 Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation
Attackers with Read permission can trigger Server-Side Request Forgery via form validation, bypassing security controls to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48923?
CVE-2026-48923 is a medium-severity server-side request forgery vulnerability in Jenkins AppSpider Plugin, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
Weakness: CWE-269
Which versions are affected by CVE-2026-48923?
2 open source packages ship an affected version, including com.rapid7:jenkinsci-appspider-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.rapid7:jenkinsci-appspider-plugin Maven | All versions | 1.0.18 |
com.rapid7:jenkinsci-appspider-plugin Maven | All versions | 1.0.18 |
Products include Jenkins Appspider.
How do I fix CVE-2026-48923?
Upgrade com.rapid7:jenkinsci-appspider-plugin to 1.0.18 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-48923 being exploited?
There is no known exploitation of CVE-2026-48923 in the wild and no public exploit code.
Other vulnerabilities in Jenkins AppSpider Plugin
Sources
Also known as GHSA-9wm7-8qf3-9v98.