CVE-2026-84662: Jenkins LDAP Plugin vulnerability

Q: What access would an attacker need to exploit this issue?

The issue is exposed through Stapler data binding. The provided information does not specify the required authentication level or permissions.

Q: What is the practical impact of exploitation?

An attacker can cause Jenkins LDAP Plugin to initiate a connection to a URL chosen by the attacker. This could expose network reachability from the Jenkins instance to attacker-specified destinations.

Q: Are default installations affected?

The available information identifies Jenkins LDAP Plugin version 807.809.vd3a_4e5e4ec98 and earlier as affected, but does not state whether the vulnerable functionality is enabled or reachable in a default Jenkins configuration.

Published Sep 2, 2026

Updated

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL.

Affected Software

1 affected component

Jenkins LDAP Plugin<=807.809.vd3a_4e5e4ec98

Event History

Sep 2, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The issue is exposed through Stapler data binding. The provided information does not specify the required authentication level or permissions.

What is the practical impact of exploitation?

An attacker can cause Jenkins LDAP Plugin to initiate a connection to a URL chosen by the attacker. This could expose network reachability from the Jenkins instance to attacker-specified destinations.

Are default installations affected?

The available information identifies Jenkins LDAP Plugin version 807.809.vd3a_4e5e4ec98 and earlier as affected, but does not state whether the vulnerable functionality is enabled or reachable in a default Jenkins configuration.