Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.6

Jenkins Active Directory Plugin accepts unsafe LDAP data

CVE-2026-48919 · published 5 months ago
Summary

Jenkins servers that use the Active Directory plugin (version 2.41 or earlier) trust information received from LDAP referrals without checking it first. This can let a malicious directory server send crafted data that could be executed on the Jenkins host. Upgrade the plugin to the latest version or remove the plugin if it is not needed.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:active-directory to version 2.41.1.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:active-directory < 2.41.1
Fix: upgrade to 2.41.1
– jenkins active_directory <= 2.41
cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published27 May 2026
Updated4 Nov 2026
First seen27 May 2026
Sources
CVE-2026-48919 · NVD
GHSA-p2gw-f3rv-82mw · GHSA
CVE-2026-48919 · OSV
Track software like this
Free during beta