Open redirect in Jenkins and Jenkins LTS - CVE-2026-53440
Published: June 22, 2026
Vulnerability identifier: #VU134983
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]
CVE-ID: CVE-2026-53440
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to the affected application does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
Affected software
Jenkins
Jenkins LTS
Jenkins LTS
How to mitigate CVE-2026-53440
Install updates from vendor's website.
Jenkins - update to 2.568
Jenkins LTS - update to 2.555.3
Jenkins LTS - update to 2.555.3