CVE-2026-48919: Jenkins Active Directory Plugin Remote Code Execution via LDAP Referrals
Summary
CVE-2026-48919: Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation. Affects org.jenkins-ci.plugins:active-directory versions < 2.41.1. Fixed in 2.41.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Directory Plugin facilitates integration with Active Directory servers, allowing Jenkins to authenticate users and manage permissions based on their Active Directory credentials. This plugin is widely used in environments where Jenkins is deployed for continuous integration and delivery, making it crucial for maintaining security and operational integrity. However, versions 2.41 and earlier of this plugin are vulnerable to a serious security flaw that can lead to remote code execution.
Vulnerability Detail
The vulnerability arises from the plugin's default behavior of following LDAP referrals from the configured Active Directory server. These referrals can redirect to an RMI URL controlled by an attacker, enabling them to send malicious serialized data to the Jenkins controller. If the controller has deserialization 'gadgets' available on its classpath, this can lead to remote code execution (RCE). Attackers who can manipulate the Active Directory server or perform a man-in-the-middle attack can exploit this vulnerability, posing a significant risk to the Jenkins environment.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.41.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the fixed version, you can mitigate the vulnerability by starting Jenkins with the following Java system property set to true: -Dhudson.plugins.active_directory.referral.ignore=true. This will prevent the plugin from following LDAP referrals by default.
Conclusion
The Jenkins Active Directory Plugin vulnerability (CVE-2026-48919) poses a significant risk due to its potential for remote code execution through LDAP referrals. It is crucial for administrators to update to the patched version or implement the provided workaround to safeguard their Jenkins instances.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
The CVSS score for this vulnerability is 6.6, indicating a moderate level of severity.
Versions 2.41 and earlier of the Jenkins Active Directory Plugin are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the plugin, you can mitigate the risk by setting the Java system property -Dhudson.plugins.active_directory.referral.ignore=true when starting Jenkins.
If exploited, this vulnerability can allow attackers to execute arbitrary code on the Jenkins controller, potentially compromising the entire Jenkins environment and any associated data.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
