PT-2026-51798 · Jenkins · Active Directory Plugin
CVE-2026-57288
·
Published
2026-06-24
·
Updated
2026-06-24
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Active Directory Plugin versions prior to 2.41.2
Description
In the Windows native (ADSI) authentication path, the software fails to escape the user name before constructing the LDAP search filter. This allows unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries or authenticate as a user if the attacker possesses the password but not the exact user name.
Recommendations
Update Jenkins Active Directory Plugin to version 2.41.2 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Active Directory Plugin