PT-2026-48422 · Jenkins · Jenkins

CVE-2026-53437 · Published 2026-06-10 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.567 Jenkins LTS versions prior to 2.555.2

Description An issue exists where the software improperly validates redirect URLs after login. When a redirect URL contains tab or newline characters between //, the system incorrectly determines that the URL is legitimately pointing to Jenkins. This flaw allows attackers to conduct phishing attacks.

Recommendations Update to version 2.567 or later. Update to LTS version 2.555.2 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-JENKINS-2026-53437

CVE-2026-53437

Affected Products

Jenkins

References · 9

• https://jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53437 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2026-53437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53437 · Security Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json · Note
• https://t.me/CVEtracker/56456 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-53437 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2487544 · Note
• https://twitter.com/CVEnew/status/2064709794460491830 · Twitter Post