CVE-2026-57288
LOWJenkins Active Directory Plugin < 2.41.1 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Title source: ruleDescription
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-06-24
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651
Scores
CVSS v3
3.7
EPSS
0.0022
EPSS Percentile
13.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-90
Status
published
Products (2)
jenkins/active_directory
< 2.41.2
Jenkins Project/Jenkins Active Directory Plugin
< 2.41.1
Published
Jun 24, 2026
Tracked Since
Jun 24, 2026