CVE-2026-48918
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
Risk Assessment
Following LDAP referrals may allow an attacker to redirect authentication to a malicious LDAP server, potentially leading to credential disclosure or unauthorized access.
Recommendation
Update Jenkins Active Directory Plugin to a version later than 2.41 if available, or disable following LDAP referrals in the configuration.
Other vulnerabilities in Jenkins Active Directory Plugin
See all- CVE-2026-48919Medium
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. This may lead to processing of untrusted data by the deserialization mechanism.
- CVE-2023-37943Medium
Jenkins Active Directory Plugin version 2.30 and earlier ignores the 'Require TLS' and 'StartTls' options, resulting in an unencrypted connection test to Active Directory servers.
Original NVD description (English source)
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS