CVE-2023-37943: Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and alway...

Security readout for executives and security teams

Jenkins Active Directory Plugin 2.30 and earlier could perform Active Directory connection tests without encryption, even when TLS options were selected. An attacker who can capture traffic between the Jenkins controller and Active Directory servers could obtain Jenkins-used AD credentials. Exposure is likely where Jenkins uses Active Directory Plugin 2.30 or earlier and administrators run connection tests over networks an attacker could monitor. Treat as a credential-protection issue for Jenkins environments integrated with Active Directory. Prioritize systems on shared, less trusted, or poorly monitored network paths. Mitigation focus: Identify Jenkins instances using Active Directory Plugin 2.30 or earlier.; Check Jenkins vendor guidance for the fixed plugin release or approved workaround.; Avoid relying on TLS settings for connection tests on affected versions..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.