Open redirect in Jenkins
Priority LOW 20CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 11 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Partial Jenkins (Jenkins Project): 2.568, 2.555.3org.jenkins-ci.main:jenkins-core (Maven): 2.555.3, 2.568Red Hat: 11 advisoriesRed Hat: 11 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | — | 2.568, 2.555.3 | Patch available | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.555.3 | 2.555.3 | Patch available | GHSA-463r-5m89-4xfr |
| — | org.jenkins-ci.main:jenkins-core (Maven) | 2.556 to before 2.568 | 2.568 | Patch available | GHSA-463r-5m89-4xfr |
- Jenkins VendorJenkins Affected — Fixed in 2.568, 2.555.3 Patch available CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.555.3 Fixed in 2.555.3 Patch available GHSA-463r-5m89-4xfr
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.556 to before 2.568 Fixed in 2.568 Patch available GHSA-463r-5m89-4xfr
Remediation
- Fix · CNA Jenkins (Jenkins Project) Fixed in 2.568, 2.555.3
- Fix · GHSA-463r-5m89-4xfr org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.555.3 Advisory →
- Fix · GHSA-463r-5m89-4xfr org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.568 Advisory →
Red Hat 11 advisories
- RHSA-2026:60259 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60256 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60254 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 8 more Red Hat advisories
- RHSA-2026:60252 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60251 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60250 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60249 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60248 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60247 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:60246 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:60239 Released 2026-08-26 · Red Hat rating ImportantRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Jenkins — Jenkins Security Advisory 2026-06-10
8 records Highest priority Priority HIGH 1 HIGH, 7 LOW
Other records, highest priority first
- TI-2026-38517 Deserialization of untrusted data in JenkinsPriority HIGH 72
- TI-2026-38523 Cross-site scripting in JenkinsPriority LOW 24
- TI-2026-38524 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST…Priority LOW 23
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:60247 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:60249 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:60248 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:60239 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:60251 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:60246 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:60250 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:60252 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:60259 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:60254 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:60256 |
Not affected: 11 products
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53437
- 2026-10-03 Alias added: GHSA-463r-5m89-4xfr
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Other 17
- https://github.com/jenkinsci/jenkins/commit/b32f2f27a82ed187a34f55b05edcc4a83563d574
- https://github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json
- https://github.com/jenkinsci/jenkins
- https://bugzilla.redhat.com/show_bug.cgi?id=2487544
- https://access.redhat.com/security/cve/CVE-2026-53437
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/errata/RHSA-2026:60256
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60239
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-53437 · CVE Program
- CVE-2026-53437 · NVD
- FIRST EPSS
- GHSA-463r-5m89-4xfr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-53437 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences