CVE-2026-84662: Jenkins LDAP Plugin SSRF Vulnerability

CVE-2026-84662 Overview

CVE-2026-84662 is a Server-Side Request Forgery (SSRF) vulnerability in the Jenkins Lightweight Directory Access Protocol (LDAP) Plugin. Versions 807.809.vd3a_4e5e4ec98 and earlier allow authenticated attackers to force the Jenkins controller to connect to an attacker-specified URL through Stapler data binding. The flaw is tracked as CWE-601 (URL Redirection to Untrusted Site) and is documented in the Jenkins Security Advisory 2026-09-02.

Critical Impact
Authenticated attackers can coerce the Jenkins controller into initiating LDAP connections to attacker-controlled endpoints, enabling internal reconnaissance and interaction with services reachable from the controller.

Affected Products

Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier
Jenkins controllers with the LDAP Plugin installed and enabled
Any Jenkins deployment relying on the affected LDAP Plugin for authentication

Discovery Timeline

2026-09-02 - Jenkins publishes Security Advisory SECURITY-3678
2026-09-02 - CVE-2026-84662 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84662

Vulnerability Analysis

The Jenkins LDAP Plugin accepts a user-controllable URL parameter and passes it directly to the LDAP connection routine. Stapler, the web framework Jenkins uses to bind HTTP request parameters to Java objects, exposes this URL field without restricting its target. An attacker with permission to submit the relevant form or endpoint can specify an arbitrary URL. The plugin then initiates an outbound connection from the Jenkins controller to that destination.

The issue matches the SSRF pattern described by CWE-601: the application trusts an externally supplied URL without validating that it points to an approved server. Impact is limited to connection initiation and potential integrity effects on Jenkins configuration data, consistent with the scoring assigned by the vendor.

Root Cause

The root cause is missing validation of the LDAP server URL parameter during Stapler data binding. The plugin does not restrict the scheme, host, or port of the target, nor does it enforce an allowlist of approved LDAP endpoints. Because Stapler automatically maps request parameters to the underlying configuration object, any authenticated user with access to the LDAP configuration endpoint can override the destination.

Attack Vector

Exploitation requires network access to the Jenkins web interface and low-privilege authenticated access. The attacker submits a crafted request that binds a malicious URL to the LDAP configuration object. The Jenkins controller then attempts an outbound LDAP connection to the attacker-specified target. Attackers can use this behavior to probe internal services, capture LDAP bind credentials sent by Jenkins, or interact with services reachable only from the controller's network segment.

No verified public exploit code is available. Refer to the Jenkins Security Advisory 2026-09-02 for vendor technical details.

Detection Methods for CVE-2026-84662

Indicators of Compromise

Outbound LDAP or LDAPS connections from the Jenkins controller to unexpected external hosts or non-standard ports
Modifications to LDAP Plugin configuration submitted by non-administrative accounts
Jenkins audit log entries showing configuration changes to the LDAP server field followed by connection attempts
DNS lookups from the Jenkins controller for domains outside the organization's directory infrastructure

Detection Strategies

Monitor Jenkins configuration change events for updates to the LDAP Plugin server URL field
Alert on outbound TCP connections from the Jenkins controller to destinations not on an approved LDAP server list
Inspect Jenkins HTTP access logs for POST requests targeting LDAP configuration endpoints from non-administrator sessions

Monitoring Recommendations

Baseline expected LDAP endpoints for each Jenkins controller and alert on deviations
Forward Jenkins audit and access logs to a centralized log platform for correlation with network telemetry
Enable egress filtering logs on the Jenkins controller's network segment to identify unauthorized destinations

How to Mitigate CVE-2026-84662

Immediate Actions Required

Upgrade the Jenkins LDAP Plugin to a version later than 807.809.vd3a_4e5e4ec98 as directed in the vendor advisory
Restrict access to Jenkins configuration endpoints so only administrators can modify authentication settings
Review recent changes to the LDAP Plugin configuration and validate the currently configured server URL

Patch Information

Jenkins has released a fixed version of the LDAP Plugin. Refer to the Jenkins Security Advisory 2026-09-02 for the specific fixed version and upgrade instructions. Apply the plugin update through the Jenkins Plugin Manager or by staging the updated .hpi file.

Workarounds

Apply egress network controls that restrict the Jenkins controller to approved LDAP server addresses and ports
Limit the Jenkins Overall/Administer permission and audit any account that can reach LDAP configuration pages
Disable the LDAP Plugin if it is not required until the patched version can be deployed

bash

# Verify installed LDAP Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i ldap

# Example egress restriction using iptables on the Jenkins host
iptables -A OUTPUT -p tcp --dport 389 -d ldap.internal.example.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 636 -d ldap.internal.example.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j REJECT
iptables -A OUTPUT -p tcp --dport 636 -j REJECT