What is the CVSS score of CVE-2026-57288?

CVE-2026-57288 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Jenkins Active Directory Plugin CVE-2026-57288

EUVD-2026-38768 LOW

LDAP Injection (CWE-90)

2026-06-24 jenkins

GHSA-gx55-p8g7-p3fh

Microsoft LDAP Code Injection Jenkins Jenkins Active Directory Plugin Jenkins Project

3.7

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-accessible login endpoint with no auth needed, but AC:H due to required ADSI configuration and wildcard precision; only limited directory enumeration for confidentiality, no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 16:22 vuln.today

CVSS changed

Jun 24, 2026 - 15:22 NVD

3.7 (None) 3.7 (LOW)

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 13:20 cve.org

LOW 3.7

DescriptionCVE.org

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

AnalysisAI

LDAP injection in Jenkins Active Directory Plugin 2.41.1 and earlier allows unauthenticated remote attackers to enumerate Active Directory entries and authenticate as any directory user they can identify via wildcard matching, provided they already know that user's password. The vulnerability is confined to the Windows native ADSI authentication path, limiting exposure to Jenkins instances running on Windows with ADSI configured. No public exploit code or active exploitation has been identified; SSVC rates it non-automatable with partial technical impact.

Technical ContextAI

The Jenkins Active Directory Plugin provides two authentication paths: a standard LDAP mode and a Windows-native mode using Active Directory Service Interfaces (ADSI). The affected code path builds an LDAP search filter by directly interpolating the user-supplied login name without sanitizing LDAP special characters. CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query) describes this root cause: when user input is concatenated into an LDAP filter string, characters such as the asterisk wildcard (*) alter filter semantics. This enables two distinct abuses - directory enumeration (sending patterns to discover valid usernames) and authentication with incomplete identity (supplying a wildcard pattern that resolves to a specific user whose password is already known). The CPE cpe:2.3:a:jenkins_project:jenkins_active_directory_plugin:*:*:*:*:*:*:*:* covers all versions through 2.41.1.

RemediationAI

Upgrade the Jenkins Active Directory Plugin to a version later than 2.41.1, as directed by the vendor advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651 - the exact fixed release version should be confirmed there, as it was not explicitly stated in the available intelligence. If immediate upgrading is not feasible, the most targeted workaround is to switch the plugin's authentication mode from Windows native (ADSI) to the standard LDAP mode, which eliminates the vulnerable code path entirely; note this may require reconfiguring directory connection settings and testing authentication flows. As an additional compensating control, restricting network access to the Jenkins login endpoint to trusted IP ranges reduces the attacker pool, with the trade-off of operational friction for distributed teams. Monitoring authentication logs for usernames containing LDAP wildcard characters (*, (, ), \) can provide detection coverage for exploitation attempts.