Sign in

6.6 Medium

CVE-2026-48917 Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation

Description

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins LDAP Plugin 807	earliest → 807.v7d7de30930cf	No fix stated

The 4 CVEs of Jenkins LDAP Plugin →

CVE-2026-84662 Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data… 4.3 Medium CVE-2026-48916 Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals 6.6 Medium CVE-2023-32978 A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an… 4.3 Medium

Do you use Jenkins LDAP Plugin?

Track this CVE Watch Jenkins LDAP Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2026-48917

Timeline

Published May 27, 2026
Last modified May 27, 2026

References

Jenkins Security Advisory 2026-05-27 www.jenkins.io

Track this CVE