CVE-2026-57288

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El Plugin de Active Directory de Jenkins 2.41.1 y anteriores no escapa el nombre de usuario antes de construir el filtro de búsqueda LDAP en la ruta de autenticación nativa de Windows (ADSI), permitiendo a atacantes no autenticados inyectar caracteres comodín LDAP para enumerar entradas de directorio y autenticarse como un usuario coincidente cuya contraseña conocen sin conocer su nombre de usuario exacto.

Information

Published : 2026-06-24 14:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-57288

Mitre link : CVE-2026-57288

CVE.ORG link : CVE-2026-57288

JSON object : View

Products Affected

jenkins

active_directory

CWE

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

{"id": "CVE-2026-57288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T14:13:46.534006Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins Active Directory Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "2.41.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T14:17:35.030", "references": [{"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-90"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name."}, {"lang": "es", "value": "El Plugin de Active Directory de Jenkins 2.41.1 y anteriores no escapa el nombre de usuario antes de construir el filtro de b\u00fasqueda LDAP en la ruta de autenticaci\u00f3n nativa de Windows (ADSI), permitiendo a atacantes no autenticados inyectar caracteres comod\u00edn LDAP para enumerar entradas de directorio y autenticarse como un usuario coincidente cuya contrase\u00f1a conocen sin conocer su nombre de usuario exacto."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "6FE2C059-5052-4FCE-A5E8-86A26841B120", "versionEndExcluding": "2.41.2"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}