CVE-2026-53440

Analyzed Analyzed - Analysis Complete

Unsafe Redirect in Jenkins Authentication

Publication date: 2026-06-10

Last updated on: 2026-06-12

Assigner: Jenkins Project

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-12

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-53440

EUVD

EUVD-2026-36024

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	jenkins	to 2.568 (exc)
jenkins	jenkins	to 2.555.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Jenkins to version 2.568 or later, or LTS 2.555.3 or later.

These versions include a fix that strips tab and newline characters before validation and rejects URLs containing // anywhere, preventing the open redirect issue.

Executive Summary

This vulnerability exists in Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier. It occurs because Jenkins does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login.

As a result, attackers can exploit this flaw to perform phishing attacks by redirecting users to a domain controlled by the attacker after they log in.

Impact Analysis

This vulnerability can impact you by enabling attackers to redirect authenticated users to malicious websites after login.

Such redirection can be used for phishing attacks, potentially leading to credential theft, malware installation, or other malicious activities.

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-53440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70