CVE-2026-53437

MEDIUM

Jenkins - URL Redirection to Untrusted Site ('Open Redirect')

Title source: rule

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

References (4)

Core 4

Core References

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-53437

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2487544

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json

Vendor Advisory vendor-advisory

Jenkins Security Advisory 2026-06-10

https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755

Scores

CVSS v3 4.3

EPSS 0.0036

EPSS Percentile 29.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (4)

jenkins/jenkins < 2.555.3

jenkins/jenkins < 2.568

Jenkins Project/Jenkins 2.555.3 - 2.555.*

Jenkins Project/Jenkins 2.568

Published Jun 10, 2026

Tracked Since Jun 10, 2026