CVE-2026-48919

MEDIUM

Jenkins Active Directory Plugin < 2.41 - Deserialization of Untrusted Data

Title source: rule
STIX 2.1

Description

Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-05-27
https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3659

Scores

CVSS v3 6.6
EPSS 0.0027
EPSS Percentile 18.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
jenkins/active_directory < 2.41
Jenkins Project/Jenkins Active Directory Plugin < 2.41
Published May 27, 2026
Tracked Since May 27, 2026