CVE-2026-48916 Jenkins LDAP Plugin follows LDAP referrals
Attackers can exploit LDAP referral following to perform Server-Side Request Forgery, potentially accessing internal resources or bypassing network restrictions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48916?
CVE-2026-48916 is a medium-severity server-side request forgery vulnerability in Jenkins LDAP Plugin, published on 27 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.
Weakness: CWE-918
Which versions are affected by CVE-2026-48916?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:ldap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:ldap Maven | All versions | 807.809.vd3a |
org.jenkins-ci.plugins:ldap Maven | All versions | 807.809.vd3a |
Products include Jenkins Ldap.
How do I fix CVE-2026-48916?
Upgrade org.jenkins-ci.plugins:ldap to 807.809.vd3a or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-48916 being exploited?
There is no known exploitation of CVE-2026-48916 in the wild and no public exploit code.
Other vulnerabilities in Jenkins LDAP Plugin
Sources
Also known as GHSA-fmjp-mw89-c6h6.