All vulnerabilities
CVE-2026-57288GHSA-gx55-p8g7-p3fh

org.jenkins-ci.plugins:active-directory: Jenkins Active Directory Plugin has an LDAP injection vulnerability

Jenkins Project org.jenkins-ci.plugins:active-directorymavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
3.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.41.2Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 2.41.2org.jenkins-ci.plugins:active-directory, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>active-directory</artifactId><version>2.41.2</version></dependency>
  • 2.41.2org.jenkins-ci.plugins:active-directory, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>active-directory</artifactId><version>2.41.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Jenkins Active Directory Plugin 2.41.1 and earlier, the Windows native (ADSI) authentication path does not escape the user name before building the LDAP search filter.

This allows unauthenticated attackers to inject LDAP wildcard characters into the user name, enabling them to enumerate directory user and group names, and to authenticate as a matching user when they know that user’s password but not their exact user name.

Active Directory Plugin 2.41.2 escapes the user name in the Windows native (ADSI) authentication path before building the LDAP search filter.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:active-directory, maven< 2.41.2GitHub
  • Jenkins Active Directory Pluginaffected: all versions through 2.41.1CVE List
  • org.jenkins-ci.plugins:active-directory, Mavenfrom first release, fixed in 2.41.2OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.18OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.19OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.20OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.21OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.22OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.23OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.24OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.25OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.26OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.27OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.28OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.29OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.30OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.31OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.32OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.33OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.34OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.35OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.36OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.37OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.38OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.39OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.41OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.42OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.43OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.44OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.45OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.46OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.47OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.48OSV
  • org.jenkins-ci.plugins:active-directory, Maven1.49OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.0OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.1OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.10OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.11OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.12OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.13OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.14OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.15OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.16OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.16.1OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.17OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.18OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.19OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.2OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.20OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.22OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.23OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.23.1OSV
  • org.jenkins-ci.plugins:active-directory, Maven2.24OSV

References 5