What is the CVSS score of CVE-2026-48918?

CVE-2026-48918 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48918?

Yes, a patch is available for CVE-2026-48918. Update the affected software to the latest version immediately.

Jenkins Active Directory Plugin CVE-2026-48918

EUVD-2026-32509 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-wrhr-54p6-q97f

SSRF Jenkins

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:14 vuln.today

CVE Published

May 27, 2026 - 15:16 nvd

MEDIUM 6.6

DescriptionCVE.org

Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

AnalysisAI

Server-Side Request Forgery in Jenkins Active Directory Plugin 2.41 and earlier enables a highly privileged attacker to abuse the plugin's default LDAP referral-following behavior to force Jenkins to issue out-of-band requests to attacker-controlled or internal network hosts. The vulnerability (CWE-918) stems from the plugin not restricting LDAP referrals by default, which can be weaponized to pivot from the Jenkins server into internal infrastructure. No public exploit code exists and SSVC confirms no known active exploitation, but the technical impact is rated total - confidentiality, integrity, and availability are all at risk if exploitation succeeds.

Technical ContextAI

The affected component is the Jenkins Active Directory Plugin (up to and including version 2.41), which integrates Jenkins with Microsoft Active Directory via LDAP. LDAP referrals are redirect instructions embedded in LDAP responses that instruct the client to query a different LDAP server or endpoint. CWE-918 (Server-Side Request Forgery) is the root cause class: when the plugin follows these referrals without restriction, the Jenkins server becomes a proxy that can be directed to make network requests to arbitrary hosts - including internal services not directly accessible to the attacker. The CVSS vector (AV:N/AC:H/PR:H) indicates the attack is network-reachable but requires high privilege and high complexity, consistent with a scenario where a highly privileged actor can influence either the LDAP server configuration or LDAP response content. The SSRF is triggered during normal LDAP authentication operations.

RemediationAI

The primary remediation is to upgrade the Jenkins Active Directory Plugin to a version newer than 2.41, as documented in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3659. Note: an exact fixed version number (e.g., 2.42) is not independently confirmed from the available input data - consult the advisory directly to identify the patched release before upgrading. As a compensating control prior to patching, administrators can review the plugin's LDAP configuration and, if the plugin exposes an option to disable referral following, set it explicitly to disabled - this removes the default behavior that introduces the SSRF path. Additionally, network-level controls restricting outbound LDAP/LDAPS (ports 389/636) from the Jenkins server to only the known, trusted Active Directory servers will limit the range of hosts reachable via injected referrals, reducing the blast radius without fully eliminating the vulnerability.