CVE-2026-57288: LDAP Injection Vulnerability in Jenkins Active Directory Plugin
Summary
CVE-2026-57288: Jenkins Active Directory Plugin has an LDAP injection vulnerability. Affects org.jenkins-ci.plugins:active-directory versions < 2.41.2. Fixed in 2.41.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Directory Plugin is a widely used extension that facilitates integration with Microsoft Active Directory for user authentication and authorization within Jenkins. This plugin allows Jenkins to leverage Windows native authentication methods, enabling seamless user management and access control. However, certain versions of this plugin are susceptible to an LDAP injection vulnerability, which can compromise the security of user data and authentication processes.
Vulnerability Detail
In Jenkins Active Directory Plugin versions 2.41.1 and earlier, the Windows native (ADSI) authentication path does not properly escape user names before constructing the LDAP search filter. This oversight allows unauthenticated attackers to inject LDAP wildcard characters into the user name. As a result, attackers can enumerate directory user and group names and potentially authenticate as a valid user if they know the user's password, even without knowing the exact user name. This vulnerability is classified under CWE-90 (LDAP Injection) and has a CVSS score of 3.7, indicating a low severity risk.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.41.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the Windows native (ADSI) authentication method in the Jenkins Active Directory Plugin settings until the plugin can be updated to a secure version.
Conclusion
The LDAP injection vulnerability in the Jenkins Active Directory Plugin poses a significant risk to user authentication and data security. It is crucial for users of this plugin to update to version 2.41.2 or later to mitigate this risk. Additionally, using tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
LDAP injection is a type of attack that exploits vulnerabilities in applications that construct LDAP queries based on user input. Attackers can manipulate the input to alter the intended LDAP query, potentially gaining unauthorized access to sensitive information.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml file, you can check for vulnerabilities without needing to access the code or install additional software.
If exploited, this vulnerability can allow attackers to enumerate user and group names in the directory and authenticate as a user if they know the corresponding password, leading to unauthorized access and potential data breaches.
No, versions later than 2.41.2 have addressed this vulnerability by properly escaping user names in the LDAP search filter, thus mitigating the risk of LDAP injection.
Utilizing tools like Vulert can help you monitor your open-source dependencies for vulnerabilities in real-time, ensuring you are alerted to any issues as they arise.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
