PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48917 Jenkins Project CVE debrief

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. This vulnerability allows an attacker to potentially execute arbitrary code through maliciously crafted LDAP referral responses. The issue stems from improper deserialization of untrusted data (CWE-502), a common attack vector in Java applications. The vulnerability was disclosed in the Jenkins security advisory dated 2026-05-27. Organizations using affected versions should prioritize updating to a patched version when available.

Vendor
Jenkins Project
Product
Jenkins LDAP Plugin
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-02
Advisory published
2026-05-27
Advisory updated
2026-06-02

Who should care

Organizations running Jenkins with LDAP authentication enabled, particularly those using LDAP referral functionality. Security teams managing CI/CD infrastructure and identity federation configurations.

Technical summary

The Jenkins LDAP Plugin versions 807.v7d7de30930cf and earlier contain a deserialization vulnerability in how LDAP referral data is processed. When the plugin receives LDAP referral responses, it deserializes the data without proper validation, potentially allowing remote code execution. The attack requires high privileges (PR:H) and high attack complexity (AC:H), but successful exploitation could result in complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The vulnerability is network-accessible (AV:N) with no user interaction required.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Jenkins LDAP Plugin to a version newer than 807.v7d7de30930cf when available
  • Monitor Jenkins security advisory for patch release
  • Review LDAP server configurations for unauthorized referral sources
  • Apply principle of least privilege to Jenkins service accounts
  • Enable network segmentation between Jenkins controllers and LDAP infrastructure
  • Review Jenkins plugin inventory for other plugins with similar deserialization patterns

Evidence notes

Vulnerability confirmed via Jenkins security advisory SECURITY-3654. CVSS 3.1 vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. CWE-502 (Deserialization of Untrusted Data) identified as root cause.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.