CVE-2026-57288

Analyzed Analyzed - Analysis Complete

LDAP Injection in Jenkins Active Directory Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-26

Assigner: Jenkins Project

Description

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-26

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-57288

EUVD

EUVD-2026-38768

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	active_directory	to 2.41.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The vulnerability exists in Jenkins Active Directory Plugin version 2.41.1 and earlier. It occurs because the plugin does not properly escape the user name before constructing the LDAP search filter in the Windows native (ADSI) authentication path.

This flaw allows unauthenticated attackers to inject LDAP wildcard characters, which can be used to enumerate directory entries and potentially authenticate as a matching user if the attacker knows that user's password, even without knowing the exact user name.

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to gather information about directory entries through LDAP wildcard injection.

Additionally, attackers may be able to authenticate as a user whose password they know without needing to know the exact user name, potentially leading to unauthorized access.

Compliance Impact

The provided information does not specify how the vulnerability in Jenkins Active Directory Plugin affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Jenkins Active Directory Plugin to a version later than 2.41.1 where the issue of not escaping user names in LDAP search filters is fixed.

Since the vulnerability allows unauthenticated attackers to inject LDAP wildcard characters and potentially authenticate as a matching user, immediate mitigation involves applying the plugin update and reviewing your Jenkins authentication configurations to ensure no unauthorized access is possible.

Hi! I’m here to help you understand CVE-2026-57288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70