The Jenkins Active Directory Plugin version 2.41 and earlier deserializes data from LDAP referrals without validating it. Deserialization of untrusted data (CWE‑502) can allow execution of arbitrary code if an attacker supplies crafted referral content. Anyone who can influence the LDAP referrals received by the plugin can potentially compromise the Jenkins instance.

Installations of the Jenkins Project Jenkins Active Directory Plugin 2.41 or older are affected. Any Jenkins environment that uses this plugin to integrate with an LDAP directory and accepts referral responses from the directory is vulnerable.

The CVSS score of 6.6 indicates medium severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The likely attack vector is a trusted LDAP server that the Jenkins instance contacts; an attacker who controls or tricks the LDAP server into returning malicious referral data can trigger the vulnerable deserialization path.