Description
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
Published: 2026-06-24
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 24 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title LDAP Injection in Jenkins Active Directory Plugin Allows Enumeration and Impersonation

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Title LDAP Wildcard Injection in Jenkins Active Directory Plugin Allows unauthenticated Enumeration and Impersonation
First Time appeared Jenkins Project
Jenkins Project jenkins Active Directory Plugin
Weaknesses CWE-83
Vendors & Products Jenkins Project
Jenkins Project jenkins Active Directory Plugin

Wed, 24 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Title LDAP Wildcard Injection in Jenkins Active Directory Plugin Allows unauthenticated Enumeration and Impersonation
Weaknesses CWE-83
CWE-90
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 13:45:00 +0000

Type Values Removed Values Added
Description Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
References

Subscriptions

Jenkins Project Jenkins Active Directory Plugin
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published:

Updated: 2026-06-24T14:14:28.743Z

Reserved: 2026-06-24T08:41:44.358Z

Link: CVE-2026-57288

cve-icon Vulnrichment

Updated: 2026-06-24T14:14:24.709Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T21:30:04Z

Weaknesses