What is the CVSS score of CVE-2026-48916?

CVE-2026-48916 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48916?

Yes, a patch is available for CVE-2026-48916. Update the affected software to the latest version immediately.

Jenkins LDAP Plugin CVE-2026-48916

EUVD-2026-32507 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-fmjp-mw89-c6h6

SSRF Jenkins

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:15 vuln.today

DescriptionCVE.org

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

AnalysisAI

Unconstrained LDAP referral following in Jenkins LDAP Plugin (≤ 807.v7d7de30930cf) enables Server-Side Request Forgery, allowing a highly privileged attacker who controls LDAP configuration to force the Jenkins server to initiate connections to arbitrary internal hosts by supplying a malicious LDAP server that returns crafted referrals. The CVSS score of 6.6 reflects genuine constraints: network-reachable but requiring both high privileges and high attack complexity, with High confidentiality, integrity, and availability impact if those barriers are cleared. SSVC assessment confirms no current exploitation and a non-automatable attack path, though technical impact is rated total; no public exploit code has been identified at time of analysis.

Technical ContextAI

LDAP referrals (defined in RFC 3296) are a protocol mechanism allowing an LDAP server to redirect a client to another LDAP server for a specific query. When a client implementation follows these referrals without validation or restriction, the application can be directed to connect to arbitrary hosts and ports specified in the referral URL - a textbook instance of CWE-918 (Server-Side Request Forgery). The Jenkins LDAP Plugin uses an LDAP client library to authenticate users against a configured directory service; by not disabling referral chasing, Jenkins will faithfully follow referrals returned by whichever LDAP server it is pointed at. The CVSS vector (AV:N/AC:H/PR:H) confirms the attack surface: network-accessible but requiring administrative control over the LDAP plugin configuration. Affected product per ENISA EUVD-2026-32507 and NVD is Jenkins LDAP Plugin through version 807.v7d7de30930cf.

RemediationAI

The primary fix is to upgrade the Jenkins LDAP Plugin to a version beyond 807.v7d7de30930cf that disables or restricts LDAP referral following, as documented in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3654. The exact patched version number is not specified in the available input data - consult the advisory directly to confirm the precise fixed release before deploying. As compensating controls pending upgrade, administrators should audit and minimize who holds Jenkins Overall/Administer privileges, since this reduces the pool of principals capable of altering LDAP configuration to enable exploitation. Additionally, implementing outbound network firewall rules on the Jenkins host to restrict LDAP connections (TCP 389 and TCP 636) to only the authorized directory server addresses will contain the SSRF blast radius by preventing Jenkins from reaching arbitrary internal endpoints even if a malicious referral is returned. Note that overly broad outbound restrictions may interfere with legitimate LDAP operations if referrals to authorized secondary directory servers are in use.