CVE-2026-53437
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
CVE-2026-53437- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-601, CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2026-36021
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
EUVD-2026-36021- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-463r-5m89-4xfr
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
GHSA-463r-5m89-4xfr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
CVE-2026-53437- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
CVE-2026-53437- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-463r-5m89-4xfr
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
GHSA-463r-5m89-4xfr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVBIT-jenkins-2026-53437 No score
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
- Record
BIT-jenkins-2026-53437- Updated
- 2026-11-02
Affected products
- jenkins
- jenkins project jenkins
- red hat openshift developer tools and services 4.12
- red hat openshift developer tools and services 4.13
- red hat openshift developer tools and services 4.14
- red hat openshift developer tools and services 4.15
- red hat openshift developer tools and services 4.16
- red hat openshift developer tools and services 4.17
- red hat openshift developer tools and services 4.18
- red hat openshift developer tools and services 4.19
- red hat openshift developer tools and services 4.20
- red hat openshift developer tools and services 4.21
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
before 2.555.3 | 2.555.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.556 up to 2.568 | 2.568 |
jenkinsBitnami |
before 2.555.3, 2.556.0 up to 2.568.0 | 2.555.32.568.0 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.555.3, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.555.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.556 up to 2.568, plus listed versions 2.5572.5582.5592.5602.561 Show 6 moreShow less2.5622.5632.5642.5652.5662.567 |
2.568 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53437 is a medium vulnerability (CVSS 4.3) in Jenkins, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.555.3.
References
jenkins.io/security/advisory/2026-06-10
access.redhat.com/security/cve/CVE-2026-53437
bugzilla.redhat.com/show_bug.cgi?id=2487544
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-53437
github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda
Left out here: 965 versions. The JSON record has them.