Jenkins LDAP Plugin CVE-2026-48917

Exploitation requires the attacker to hold Jenkins administrative-level privileges (CVSS PR:H), ruling out unauthenticated or low-privileged attackers entirely. High attack complexity (CVSS AC:H) further requires that the attacker be able to control or manipulate an LDAP referral destination - either by owning a server reachable via LDAP referral, by modifying LDAP plugin configuration directly (which itself requires admin access), or by achieving man-in-the-middle positioning between Jenkins and the LDAP server. The Jenkins instance must be configured to use LDAP authentication via this plugin, and the LDAP server configuration must permit or return referrals during query processing. Limiting factors: PR:H eliminates external unauthenticated attackers; AC:H requires infrastructure-level access or control over LDAP referral targets; exploitation is further bounded to Jenkins versions with the LDAP Plugin installed and actively configured.

The CVSS 3.1 base score of 6.6 (Medium) captures a significant tension: the potential impact is catastrophic (C:H/I:H/A:H - full compromise of confidentiality, integrity, and availability on the Jenkins host), but two major barriers constrain exploitation. First, PR:H indicates an attacker must hold high-privilege (administrative) credentials on the Jenkins instance, dramatically narrowing the exploitable attacker population. Second, AC:H reflects that specific conditions must align - either the attacker controls an LDAP referral target or is positioned to intercept referral resolution. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and lack of any identified public exploit code suggest no observed active exploitation at time of analysis. For organizations with tightly controlled Jenkins admin access, real-world risk is substantially lower than the CIA:H triad implies. For organizations with loosely managed Jenkins administrative accounts or externally reachable LDAP infrastructure, the risk is materially higher. CVSS and description are internally consistent - no conflicting signals detected.

An attacker who has obtained Jenkins administrative credentials accesses the LDAP plugin configuration and modifies the LDAP server settings or leverages existing referral chaining to redirect authentication queries to a malicious LDAP server under attacker control. When Jenkins processes user authentication and follows the referral, the adversary-controlled server returns a crafted serialized Java object payload; the plugin deserializes it without validation, triggering a gadget chain that executes arbitrary OS commands in the context of the Jenkins process user. No public proof-of-concept code has been identified at time of analysis.