CVE-2026-57288
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Jun 24, 2026
CISA due date
—
The record
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before… CWE-90
- CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-90
- CVE-2026-75020 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
- CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
- CVE-2026-76373 In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with… CWE-90
- CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. CWE-90
- CVE-2026-74241 A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP)… CWE-90
- CVE-2026-16071 A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user… CWE-90