Low severity · published Jun 24, 2026
CVE-2026-57288
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing…
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jenkins Active Directory Plugin · Jenkins Project
through 2.41.1 · source: vendor
AD
Active Directory · Jenkins
before 2.41.2 · source: NVD
Affected product
JA
Jenkins Active Directory Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57288
Vendor Advisory
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651
More from Jenkins Active Directory Plugin
7.4
CVE-2019-1003009
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in…
6.6
CVE-2026-48919
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation
6.6
CVE-2026-48918
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default