{"items":[{"id":"NVI-00017741","kind":"vulnerability","title":"Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p2gw-f3rv-82mw","CVE-2026-48919"],"plain_summary":"GitHub lists this reviewed advisory for org.jenkins-ci.plugins:active-directory. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-566d3e8c6ccf7fc457c342b7f6f725e1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-01T19:39:06.000Z","value":"6.6 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-566d3e8c6ccf7fc457c342b7f6f725e1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-566d3e8c6ccf7fc457c342b7f6f725e1","url":"https://github.com/advisories/GHSA-p2gw-f3rv-82mw","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p2gw-f3rv-82mw","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:49:14.191Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-566d3e8c6ccf7fc457c342b7f6f725e1"],"technology":"org.jenkins-ci.plugins:active-directory","known_exclusions":[],"conditions_summary":"Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization \"gadgets\" are available on the classpath.\n\nThis allows attackers able to control the configured Active Directory server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.\n\nActive Directory Plugin 2.41.1 no longer follows LDAP referrals by default.\n\nAdministrators unable to update to a fixed version can start Jenkins with the Java system property `hudson.plugins.active_directory.referral.ignore` set to `true` to mitigate the vulnerability.\n\nAdministrators of Jenkins controllers requiring following LDAP referrals can set the Java system property `hudson.plugins.active_directory.referral.ignore` to `false` to restore the previous behavior.","public_affected_ranges":["< 2.41.1"]}],"null_published_at":"2026-11-05T19:10:21.460Z","source_updated_at":"2026-07-01T19:39:06.000Z","source_disclosed_at":"2026-05-27T15:33:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:49:14.191Z"}],"next_cursor":null,"snapshot_revision":"42594"}