The Jenkins Active Directory Plugin up to version 2.41 automatically follows LDAP referrals, which can allow an attacker to influence the plugin to contact arbitrary LDAP servers. This behavior may enable retrieval of sensitive directory information or cross‑forest data that the attacker should not normally access. The weakness is classified as CWE‑918, a subtype of LDAP injection where untrusted input leads to denied or unintended access.

The vulnerability is present in the Jenkins Project’s Active Directory Plugin, affecting all releases 2.41 and earlier.

With a CVSS score of 6.6 the vulnerability is considered moderate. EPSS is not available and the entry is not listed in CISA KEV. The likely attack vector is inferred to involve an attacker manipulating LDAP responses or sending a crafted referral, causing the plugin to follow that referral and potentially expose directory data. The absence of an EPSS score indicates that it has not been widely exploited, and the CVE is not currently listed in known exploited lists.