CVE-2026-48917

MEDIUM

Jenkins LDAP Plugin < 807.v7d7de30930cf - Deserialization of Untrusted Data from LDAP Referrals

Title source: llm
STIX 2.1

Description

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-05-27
https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3654

Scores

CVSS v3 6.6
EPSS 0.0027
EPSS Percentile 18.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (3)
jenkins/ldap 807.v7d7de30930cf
jenkins/ldap < 793.v754d6b_41b_ea_4
Jenkins Project/Jenkins LDAP Plugin < 807.v7d7de30930cf
Published May 27, 2026
Tracked Since May 27, 2026