Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:active-directory | maven | < 2.41.1 | 2.41.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the default behavior of the Active Directory Plugin, which was to follow LDAP referrals. This could be exploited for Server-Side Request Forgery (SSRF) and, if a suitable gadget is available on the classpath, Remote Code Execution (RCE) through deserialization. The analysis of the patch between the vulnerable version (2.41) and the fixed version (2.41.1) clearly shows the change that mitigates this vulnerability. The commit a62fcfb343e232ef87b749c2c0f19bde7112db40 modifies the hudson.plugins.active_directory.ActiveDirectorySecurityRealm.java file. Specifically, inside the bind method of the ActiveDirectorySecurityRealm.DescriptorImpl inner class, the default handling of LDAP referrals was changed. Previously, the system property hudson.plugins.active_directory.referral.ignore defaulted to false, causing LDAP referrals to be followed. The patch changes this default to true, thus ignoring referrals by default and preventing the vulnerability. The vulnerable function is hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.bind because it is responsible for establishing the LDAP connection with the insecure default setting.
