CVE-2026-48919: Jenkins Active Directory Plugin deserialization via LDAP referrals

CVE-2026-48919 · Severity: medium · CVSS 6.6 · Published 2026-05-27

The Jenkins Active Directory Plugin, which allows Jenkins to use Active Directory for user authentication, is vulnerable to a security flaw when processing server referrals. An attacker who controls a malicious Active Directory server or can intercept network traffic can force the Jenkins controller to execute unauthorized code. This could lead to a full system takeover, data theft, or disruption of the CI/CD pipeline.

Technologies: org.jenkins-ci.plugins:active-directory (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-48919 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48919 being exploited in the wild.
How severe is CVE-2026-48919?
Medium severity, with a CVSS score of 6.6, published 27 May 2026.
Which products and versions are affected?
Jenkins Active Directory Plugin <= 2.41; org.jenkins-ci.plugins:active-directory (Maven) < 2.41.1, ECOSYSTEM:introduced=0,fixed=2.41.1.
Is there a fix for CVE-2026-48919?
Yes. org.jenkins-ci.plugins:active-directory (Maven): upgrade to 2.41.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48919 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48919?
Check whether you run Jenkins Active Directory Plugin or org.jenkins-ci.plugins:active-directory (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:active-directory (Maven): upgrade to 2.41.1 or later
    # set org.jenkins-ci.plugins:active-directory to 2.41.1 in your pom.xml or build.gradle

Technical details

The Jenkins Active Directory Plugin (versions 2.41 and earlier) follows LDAP referrals by default without sufficient validation. An attacker capable of controlling the configured Active Directory server or performing a Machine-in-the-Middle (MitM) attack can provide a referral pointing to a malicious RMI URL. This causes the Jenkins controller to fetch and deserialize attacker-controlled data. If suitable 'gadget' classes exist on the classpath, this leads to Remote Code Execution (RCE). The vulnerability is addressed in version 2.41.1 by disabling referral following by default, or can be mitigated via the 'hudson.plugins.active_directory.referral.ignore' system property.

Affected products

  • Jenkins Active Directory Plugin <= 2.41

Identifiers

  • CVE-2026-48919
  • GHSA-p2gw-f3rv-82mw

Timeline

  • 2026-05-27: advisory
  • 2026-05-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.