PT-2026-55122 · Maven · Org.Jenkins-Ci.Plugins:Ldap

Publicado 2026-05-27 · Atualizado 2026-05-27

OSV

CVSS v3.1

6.6

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals from the configured LDAP server. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization "gadgets" are available on the classpath.

This allows attackers able to control the configured LDAP server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.

LDAP Plugin 807.809.vd3a 4e5e4ec98 no longer follows LDAP referrals.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

GHSA-FMJP-MW89-C6H6

Produtos afetados

Org.Jenkins-Ci.Plugins:Ldap

Referências · 4

• https://github.com/jenkinsci/ldap-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-48916 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fmjp-mw89-c6h6 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3654 · Nota