CVE-2026-48918: Jenkins Active Directory Plugin RCE via LDAP referral following

CVE-2026-48918 · Severity: medium · CVSS 6.6 · Published 2026-05-27

The Jenkins Active Directory plugin, which allows users to log into Jenkins using their corporate directory credentials, contains a security flaw in how it handles directory server responses. If an attacker can control the Active Directory server or intercept network traffic, they can redirect Jenkins to a malicious server. This can lead to the attacker executing unauthorized code on the Jenkins controller, potentially compromising the entire build system and sensitive automation data.

Technologies: org.jenkins-ci.plugins:active-directory (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-48918 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48918 being exploited in the wild.
How severe is CVE-2026-48918?
Medium severity, with a CVSS score of 6.6, published 27 May 2026.
Which products and versions are affected?
Jenkins Active Directory Plugin 2.41 and earlier; org.jenkins-ci.plugins:active-directory (Maven) < 2.41.1, ECOSYSTEM:introduced=0,fixed=2.41.1.
Is there a fix for CVE-2026-48918?
Yes. org.jenkins-ci.plugins:active-directory (Maven): upgrade to 2.41.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48918 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48918?
Check whether you run Jenkins Active Directory Plugin or org.jenkins-ci.plugins:active-directory (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:active-directory (Maven): upgrade to 2.41.1 or later
    # set org.jenkins-ci.plugins:active-directory to 2.41.1 in your pom.xml or build.gradle

Technical details

The Jenkins Active Directory Plugin versions 2.41 and earlier follow LDAP referrals by default without validation. An attacker who controls the configured Active Directory server or can perform a Machine-in-the-Middle (MitM) attack can provide a referral to a malicious RMI URL. This triggers the Jenkins controller to deserialize untrusted data. If suitable 'gadget' classes are present on the classpath, this results in Remote Code Execution (RCE). The vulnerability is classified as a combination of Server-Side Request Forgery (SSRF) and insecure deserialization. Version 2.41.1 fixes this by disabling referral following by default.

Affected products

  • Jenkins Project Active Directory Plugin <= 2.41

Identifiers

  • CVE-2026-48918
  • GHSA-wrhr-54p6-q97f

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory
  • 2026-05-27: patched: Fixed in version 2.41.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.