GHSA-92m7-4fpw-2wxm
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"
At a glance
- Published
- Updated
- CVE
- CVE-2026-53440
- Aliases
- BIT-jenkins-2026-53440
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 2.555.3 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 2.556, fixed 2.568 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53440 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/38071826c9a2113e1104714595262827a87b392f WEB
- https://github.com/jenkinsci/jenkins/commit/c45e93f2d77d94ea3b0545eb5aca32b808a27586 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3721 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |