6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48919

CVE-2026-48919: Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48919

CVE-2026-48919:

6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:active-directory	maven	< 2.41.1	2.41.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the bind method of the hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl class. Before the patch, this method was configured to follow LDAP referrals by default by setting Context.REFERRAL to "follow". This behavior could be exploited by an attacker to force the Jenkins controller to connect to a malicious RMI server, leading to Remote Code Execution through deserialization of untrusted data. The provided patch addresses this by changing the default value of the hudson.plugins.active_directory.referral.ignore system property to "true", which in turn sets Context.REFERRAL to "ignore". The analysis of the commit a62fcfb343e232ef87b749c2c0f19bde7112db40 clearly shows the removal of the vulnerable code that defaulted to following referrals and its replacement with code that defaults to ignoring them. The vulnerable function is hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.bind as it is the function that establishes the LDAP connection with the insecure setting.

Vulnerable functions

hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.bind

src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java

The `bind` method in the `ActiveDirectorySecurityRealm.DescriptorImpl` class was vulnerable because it set the `Context.REFERRAL` property to "follow" by default. This allowed an attacker who could control the Active Directory server or perform a man-in-the-middle attack to redirect the Jenkins controller to a malicious RMI server. This could lead to the deserialization of untrusted data and result in Remote Code Execution. The patch changes the default behavior to ignore referrals, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.