Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Jenkins Active Directory Plugin versions up to and including 2.41.1 are vulnerable to LDAP injection in the Windows native (ADSI) authentication path, which does not escape user names before building the LDAP search filter. An unauthenticated attacker can use LDAP wildcard characters in the user name to enumerate directory user and group names, and can log in as a matching user if they know that user's password but not the exact user name. Upgrade to version 2.41.2, which escapes the user name in this path.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 3.7 | Low | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0033, the 26th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:16 UTC First seen by agentprime
- 31 Oct 2026, 14:16 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-gx55-p8g7-p3fh
- OSV: GHSA-gx55-p8g7-p3fh
- nvd.nist.gov/vuln/detail/CVE-2026-57288
- github.com/jenkinsci/active-directory-plugin/commit/5028dea8e0acc45ff9d6be302d4e1cbc1f9da464
- github.com/jenkinsci/active-directory-plugin
- github.com/jenkinsci/active-directory-plugin/releases/tag/active-directory-2.41.2
- www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651