4.3
Medium
CVE-2026-53437 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately…
Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins 2.568 | earliest → < 2.568 | 2.568 |
| Jenkins 2.555 | earliest → < 2.555.3 | 2.555.3 |
| OpenShift Developer Tools and Services | Versions not published | |
| OpenShift Developer Tools and Services 4.12 1786628667 | earliest → < 1786628667 | 1786628667 |
| OpenShift Developer Tools and Services 4.13 1786628681 | earliest → < 1786628681 | 1786628681 |
| OpenShift Developer Tools and Services 4.14 1786533561 | earliest → < 1786533561 | 1786533561 |
| OpenShift Developer Tools and Services 4.15 1786533565 | earliest → < 1786533565 | 1786533565 |
| OpenShift Developer Tools and Services 4.16 1787125166 | earliest → < 1787125166 | 1787125166 |
| OpenShift Developer Tools and Services 4.17 1787124635 | earliest → < 1787124635 | 1787124635 |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift Developer Tools and Services 4.18 1787125069 | earliest → < 1787125069 | 1787125069 |
| OpenShift Developer Tools and Services 4.19 1787124632 | earliest → < 1787124632 | 1787124632 |
| OpenShift Developer Tools and Services 4.20 1787124925 | earliest → < 1787124925 | 1787124925 |
| OpenShift Developer Tools and Services 4.21 1787125311 | earliest → < 1787125311 | 1787125311 |
| OpenShift Developer Tools and Services 4.22 1787124779 | earliest → < 1787124779 | 1787124779 |
References
- Jenkins Security Advisory 2026-06-10 www.jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins
The 153 CVEs of Jenkins →
CVE-2026-117626
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the…
4.3
Medium
CVE-2026-117624
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing…
8.8
High
CVE-2026-117625
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read…
4.3
Medium
CVE-2026-117623
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar…
5.4
Medium