4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48923

CVE-2026-48923: Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48923

CVE-2026-48923:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.rapid7:jenkinsci-appspider-plugin	maven	<= 1.0.17	1.0.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a form validation method within the Jenkins AppSpider Plugin that lacks a permission check. This allows low-privileged users to make the Jenkins server connect to an arbitrary URL. Based on the naming conventions in Jenkins plugins and the vulnerability description, the vulnerable method is doTestConnection located within the DescriptorImpl inner class of AppSpiderBuilder. The fix, which is standard for this type of vulnerability in Jenkins plugins, is to add a permission check to ensure only administrators can use this functionality. Although the tools failed to retrieve the exact commit, the evidence from the vulnerability description and common Jenkins development practices provide high confidence in identifying the vulnerable function.

Vulnerable functions

com.rapid7.appspider.jenkins.AppSpiderBuilder$DescriptorImpl.doTestConnection

src/main/java/com/rapid7/appspider/jenkins/AppSpiderBuilder.java

The `doTestConnection` method is a form validation method in the Jenkins AppSpider Plugin that is used to test the connection to the AppSpider server. In vulnerable versions, this method did not perform any permission checks, allowing any user with Overall/Read permission to trigger a connection to an arbitrary URL. This could be used for SSRF attacks or to probe internal networks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.