CVE-2026-48917 Jenkins LDAP Plugin deserializes data from LDAP referrals without validation
Attackers can execute arbitrary code by sending malicious LDAP referrals to Jenkins instances using the vulnerable LDAP plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48917?
CVE-2026-48917 is a medium-severity unsafe deserialization vulnerability in Jenkins LDAP Plugin, published on 27 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.
Weakness: CWE-502
Which versions are affected by CVE-2026-48917?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:ldap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:ldap Maven | All versions | 807.809.vd3a |
org.jenkins-ci.plugins:ldap Maven | All versions | 807.809.vd3a |
Products include Jenkins Ldap.
How do I fix CVE-2026-48917?
Upgrade org.jenkins-ci.plugins:ldap to 807.809.vd3a or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-48917 being exploited?
There is no known exploitation of CVE-2026-48917 in the wild and no public exploit code.
Other vulnerabilities in Jenkins LDAP Plugin
Sources
Also known as GHSA-x9v8-p946-5pwc.