CVE-2026-53437
Fixed in a distro release EPSS <1%CVSS 4.3
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Products: Jenkins project Jenkins, Red Hat OpenShift Developer Tools and Services 4.12, Red Hat OpenShift Developer Tools and Services 4.13, Red Hat OpenShift Developer Tools and Services 4.14, Red Hat OpenShift Developer Tools and Services 4.15, Red Hat OpenShift Developer Tools and Services 4.16, Red Hat OpenShift Developer Tools and Services 4.17, Red Hat OpenShift Developer Tools and Services 4.18, Red Hat OpenShift Developer Tools and Services 4.19, Red Hat OpenShift Developer Tools and Services 4.20, Red Hat OpenShift Developer Tools and Services 4.21, Red Hat OpenShift Developer Tools and Services 4.22
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.555.3 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.568 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins-2.528 | no fix |
| Chainguard | jenkins-2.541 | no fix |
| Chainguard | jenkins-2.541-openjdk-17 | no fix |
| Chainguard | jenkins-2.541-openjdk-21 | no fix |
| Chainguard | jenkins-2.541-openjdk-25 | no fix |
| Chainguard | jenkins-2.555 | 2.555.3-r0 |