CVE-2026-48918: Jenkins Active Directory Plugin Remote Code Execution Vulnerability
Summary
CVE-2026-48918: Jenkins Active Directory Plugin follows LDAP referrals by default. Affects org.jenkins-ci.plugins:active-directory versions < 2.41.1. Fixed in 2.41.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Directory Plugin is a widely used plugin that integrates Jenkins with Active Directory, allowing for user authentication and authorization. It simplifies the management of user permissions and roles within Jenkins by leveraging existing Active Directory configurations. However, versions 2.41 and earlier of this plugin have a critical security flaw that can be exploited by attackers.
Vulnerability Detail
The Jenkins Active Directory Plugin versions 2.41 and earlier follow LDAP referrals from the configured Active Directory server by default. This behavior can be exploited by attackers who control the Active Directory server or can perform a man-in-the-middle attack. By forwarding LDAP referrals to an RMI URL, attackers can cause Jenkins to deserialize malicious data, leading to Remote Code Execution (RCE) on the Jenkins controller if deserialization gadgets are present on the classpath. This vulnerability poses a significant risk, as it allows unauthorized code execution on the Jenkins server.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.41.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the fixed version, you can mitigate the vulnerability by starting Jenkins with the following Java system property set to true: -Dhudson.plugins.active_directory.referral.ignore=true. This will prevent the plugin from following LDAP referrals. If you need to restore the previous behavior, set the property to false: -Dhudson.plugins.active_directory.referral.ignore=false.
Conclusion
The Jenkins Active Directory Plugin has a significant vulnerability that can lead to Remote Code Execution if not addressed. It is crucial for administrators to update to the latest version or implement the recommended workarounds to secure their Jenkins environments.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
Versions 2.41 and earlier of the Jenkins Active Directory Plugin are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the plugin, you can mitigate the risk by setting the Java system property -Dhudson.plugins.active_directory.referral.ignore=true when starting Jenkins.
If exploited, this vulnerability can lead to Remote Code Execution (RCE) on the Jenkins controller, allowing attackers to execute arbitrary code.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
