CVE-2026-57288: Jenkins Active Directory Plugin LDAP Injection & Authentication Bypass

Technical summary

CVE-2026-57288 is an LDAP injection vulnerability (CWE-90) in the Windows native ADSI authentication path of Jenkins Active Directory Plugin. The plugin fails to escape user-supplied input before constructing LDAP filter strings, enabling two attack vectors: (1) wildcard injection to enumerate directory objects and (2) authentication bypass when the attacker possesses a valid password but not the corresponding username. The vulnerability affects version 2.41.1 and all earlier releases. The CVSS 3.1 score of 3.7 (LOW) reflects limited confidentiality impact, high attack complexity, and no integrity or availability impact.

Business impact

This vulnerability primarily enables directory reconnaissance and selective credential-based authentication bypass. An insider or external attacker with a stolen password but no username knowledge could potentially gain unauthorized access. More broadly, enumeration of directory entries may expose user and group naming conventions, aiding social engineering or follow-up attacks. For organizations relying on Jenkins for CI/CD pipeline access control, unauthorized access could lead to pipeline manipulation, code theft, or supply chain compromise. The impact is heightened in environments where Jenkins handles secrets, deployment keys, or integration with sensitive systems.

Affected systems

Jenkins Active Directory Plugin versions 2.41.1 and earlier are vulnerable. This affects Jenkins instances configured to use Windows native (ADSI) authentication via the Active Directory plugin. Organizations using other authentication methods (LDAP, SAML, built-in Jenkins auth) are not affected. The scope is limited to Jenkins deployments that explicitly integrate with Active Directory through this plugin.

Exploitability

Exploitation requires network access to the Jenkins instance and either (a) knowledge of a valid password to perform authentication bypass, or (b) the ability to inject LDAP wildcards to enumerate users. Attack complexity is rated as high because successful exploitation depends on knowing valid credentials or guessing appropriate wildcard patterns. No public exploit is tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is not trivial to exploit blindly but is straightforward for an attacker with partial credentials or inside knowledge of the directory structure.

Remediation

Update Jenkins Active Directory Plugin to version 2.42.0 or later, which properly escapes usernames in LDAP filter construction. Verify the updated version is compatible with your Jenkins version before deployment. Apply the patch during a maintenance window to avoid service interruption. Monitor authentication logs for suspicious login attempts using wildcard patterns or unusual usernames.

Patch guidance

1. Navigate to Jenkins > Manage Jenkins > Manage Plugins. 2. Search for 'Active Directory' and verify the current version. 3. If on 2.41.1 or earlier, click 'Upgrade' to install the latest patched version (verify against the vendor advisory for the exact minimum safe version). 4. Restart Jenkins or use the 'Restart when no jobs are running' option. 5. Confirm authentication still functions by testing a known user login. 6. Review release notes to ensure no deprecated features or configuration changes affect your setup.

Detection guidance

Monitor Jenkins authentication logs for: (1) username fields containing LDAP wildcard characters (*) or special characters (parentheses, pipes); (2) multiple failed authentication attempts from the same source using malformed usernames; (3) successful logins with unusual username patterns. Enable and review Active Directory plugin debug logging if available. Query your Active Directory audit logs for unexpected LDAP filter patterns or unusual search volumes. Set up alerts for authentication failures followed immediately by successful login with different username formats.

Why prioritize this

Although rated LOW severity, this vulnerability merits timely patching because: (1) it enables credential-based access without username knowledge, creating a real authentication bypass path; (2) directory enumeration can seed further attacks; (3) Jenkins is commonly a high-value target controlling deployment pipelines and secrets; (4) the fix is simple and low-risk; (5) organizational data governance and access control depend on correct identity verification.

Risk score, explained

CVSS 3.1 assigns a score of 3.7 (LOW) because the attack requires high complexity (valid password knowledge or guessing), delivers only confidentiality impact (user enumeration), and cannot cause integrity or availability damage directly. However, this score reflects technical exploitability, not business context—a successful authentication bypass on Jenkins could have disproportionate downstream impact on your CI/CD pipeline and secrets management.

Frequently asked questions