Executive brief
The Jenkins LDAP Plugin is an authentication component used to connect Jenkins to corporate directory services. A vulnerability in versions 807.809 and earlier allows attackers to use Stapler framework data binding to redirect LDAP connections to attacker-specified URLs, potentially intercepting authentication attempts or performing credential harvesting attacks.
Technical details
This vulnerability (CVE-2026-84662) exploits a type-restriction bypass in Stapler's data binding mechanism within the LDAP Plugin. The flaw allows attackers with Overall/Read permission to instantiate arbitrary configuration objects by submitting crafted form data, enabling them to specify an attacker-controlled URL for LDAP connections. The vulnerability is related to SECURITY-3915 (CVE-2026-84647) and affects Stapler versions 2107.v8dfcb_e8ed317 and earlier. Jenkins patched this class of vulnerability in version 2.580 and LTS 2.568.3 by restricting types instantiable via form data binding to only those compatible with the expected field type. Network reachability and read-level permissions are required to exploit this.
Affected products
- Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier
Timeline
- 2026-09-02: disclosed: CVE-2026-84662 published
- 2026-09-02: patched: Fix available in Jenkins 2.580 and LTS 2.568.3 via Stapler update