CVE-2026-48919
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. This may lead to processing of untrusted data by the deserialization mechanism.
Risk Assessment
An attacker able to influence LDAP referral content may achieve code execution in the context of the Jenkins server. This could result in takeover of the CI/CD server.
Recommendation
Update the Jenkins Active Directory Plugin to a version newer than 2.41. Until then, limit the ability to manipulate LDAP referrals and monitor for unusual Jenkins server activity.
Other vulnerabilities in Jenkins Active Directory Plugin
See all- CVE-2026-48918Medium
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
- CVE-2023-37943Medium
Jenkins Active Directory Plugin version 2.30 and earlier ignores the 'Require TLS' and 'StartTls' options, resulting in an unencrypted connection test to Active Directory servers.
Original NVD description (English source)
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS