Executive brief
The Jenkins Active Directory Plugin, which allows Jenkins to use Active Directory for user authentication, is vulnerable to a security flaw when processing server referrals. An attacker who controls a malicious Active Directory server or can intercept network traffic can force the Jenkins controller to execute unauthorized code. This could lead to a full system takeover, data theft, or disruption of the CI/CD pipeline.
Technical details
The Jenkins Active Directory Plugin (versions 2.41 and earlier) follows LDAP referrals by default without sufficient validation. An attacker capable of controlling the configured Active Directory server or performing a Machine-in-the-Middle (MitM) attack can provide a referral pointing to a malicious RMI URL. This causes the Jenkins controller to fetch and deserialize attacker-controlled data. If suitable 'gadget' classes exist on the classpath, this leads to Remote Code Execution (RCE). The vulnerability is addressed in version 2.41.1 by disabling referral following by default, or can be mitigated via the 'hudson.plugins.active_directory.referral.ignore' system property.
Affected products
- Jenkins Active Directory Plugin <= 2.41
Timeline
- 2026-05-27: advisory
- 2026-05-27: patched