Executive brief
The Jenkins Active Directory plugin, which allows users to log into Jenkins using their corporate directory credentials, contains a security flaw in how it handles directory server responses. If an attacker can control the Active Directory server or intercept network traffic, they can redirect Jenkins to a malicious server. This can lead to the attacker executing unauthorized code on the Jenkins controller, potentially compromising the entire build system and sensitive automation data.
Technical details
The Jenkins Active Directory Plugin versions 2.41 and earlier follow LDAP referrals by default without validation. An attacker who controls the configured Active Directory server or can perform a Machine-in-the-Middle (MitM) attack can provide a referral to a malicious RMI URL. This triggers the Jenkins controller to deserialize untrusted data. If suitable 'gadget' classes are present on the classpath, this results in Remote Code Execution (RCE). The vulnerability is classified as a combination of Server-Side Request Forgery (SSRF) and insecure deserialization. Version 2.41.1 fixes this by disabling referral following by default.
Affected products
- Jenkins Project Active Directory Plugin <= 2.41
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched: Fixed in version 2.41.1