{"id":"GHSA-wrhr-54p6-q97f","summary":"Jenkins Active Directory Plugin follows LDAP referrals by default","details":"Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization \"gadgets\" are available on the classpath.\n\nThis allows attackers able to control the configured Active Directory server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.\n\nActive Directory Plugin 2.41.1 no longer follows LDAP referrals by default.\n\nAdministrators unable to update to a fixed version can start Jenkins with the Java system property `hudson.plugins.active_directory.referral.ignore` set to `true` to mitigate the vulnerability.\n\nAdministrators of Jenkins controllers requiring following LDAP referrals can set the Java system property `hudson.plugins.active_directory.referral.ignore` to `false` to restore the previous behavior.","aliases":["CVE-2026-48918"],"modified":"2026-07-01T19:56:31.552023Z","published":"2026-05-27T15:33:26Z","database_specific":{"nvd_published_at":"2026-05-27T15:16:31Z","cwe_ids":["CWE-918"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-01T19:30:25Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48918"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/active-directory-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3659"}],"affected":[{"package":{"name":"org.jenkins-ci.plugins:active-directory","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins/active-directory"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.1"}]}],"versions":["1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.30","1.31","1.32","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.41","1.42","1.43","1.44","1.45","1.46","1.47","1.48","1.49","2.0","2.1","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.16.1","2.17","2.18","2.19","2.2","2.20","2.22","2.23","2.23.1","2.24","2.24.1","2.25","2.25.1","2.26","2.27","2.28","2.29","2.3","2.30","2.30.1","2.31","2.32","2.33","2.34","2.35","2.36","2.37","2.38","2.39","2.4","2.40","2.41","2.5","2.6","2.7","2.8","2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-wrhr-54p6-q97f/GHSA-wrhr-54p6-q97f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}